Solved: Both Active and Standby AWS Cloudguard reply to HT... - Check Point CheckMates

Both Active and Standby AWS Cloudguard reply to HTTPS probes

Hello CheckMates,

I am trying to understand, why Checkpoint CloudGuard standby gateway in AWS is replying to my 443 health probes?

My management portal has been moved from the default port to 9443,

I have tried to configure $FWDIR/boot/modules/fwkern.conf with a cloud_balancer_port=8117 as per https://support.checkpoint.com/results/sk/sk181836 but it seems like the behavior is different than in Azure. It will actually forward the probes to the endpoint server, and as a regular webserver - it does listen to 443, not 8117.

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

1 Solution

Accepted Solutions

Nir_Shamir

Employee

‎2025-11-2810:07 PM

Show option menu

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to reybanger

Jump to solution

What kind of deployment do you exactly have ?

from what you wrote it looks like a Cluster HA and with Clusters in AWS we use the “virtual IP” as the destination because it forwards the traffic to the ACTIVE member.

in AWS we use LB’s only with Autoscale deployments.

View solution in original post

1\ \ \ Kudo

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

3 Replies

_Val_

Admin

‎2025-11-2704:44 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

Jump to solution

HTTPS port on a standby GW answering probes is a normal situation. HTTPS is open in one of many scenarios, when specific blades, such as RAS VPN, Mobile access, Identity Awareness, and more, are enabled.

Why does it cause an issue for you?

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

reybanger

Contributor

‎2025-11-2705:47 AM

Mark as New
Bookmark
Subscribe
Mute
Subscribe to RSS Feed
Permalink
Print
Report Inappropriate Content

In response to _Val_

Jump to solution

Thank you for replying. This is basically to avoid session issues or asymmetric traffic. IT would be nice if Checkpoint would work in a similar way like in Azure - where the traffic from LB is forwarded only to active member.

I am looking for some options here to point traffic to my backend servers listening on 443 using load balancer in front.

Kudos

Click here to give kudos to this post.

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5