AWS ClusterXL High Availability - Check Point CheckMates

AWS ClusterXL High Availability

We are facing an issue with our Check Point firewall cluster deployed in AWS and would appreciate your guidance.

Environment:

• Check Point Version: R81.20
• Deployment: AWS ClusterXL High Availability

Issue:

When Member A is Standby, Internet or ping to any host on the internet is working normally.
As soon as Member A becomes Active (after failover or manual switch), Internet connectivity stops for users and even from the firewall it stops.
The cluster status appears healthy, and traffic exiting from WAN interface but no return traffic is observed.

Troubleshooting performed:

• Verified ClusterXL status.
• Verified firewall policy and NAT.
• Same route table on both gateways.

Could anyone suggest what AWS or Check Point components should be checked? Specifically, are there any known issues related to:

• AWS route tables
• Source/Destination Check
• Elastic IP failover
• ENI attachment
• ClusterXL synchronization
• CloudGuard Controller or failover automation

Responses:

Chris Atkinson:

Everything good with your IAM roles? Any errors with the HA script?
The APIs do take some time to enact the failover from memory. How soon after are you testing before failing back again?
CCSM R77/R80/ELITE

Nir Shamir:

Verify that your GW's can send API calls to AWS. Run:

$FWDIR/scripts/aws_ha_test.py

and see if there are any errors.