Site to Site VPN outage on ClusterXL Active member when running "cpstop" on the Standby cluster member

Product: ClusterXL, IPSec VPN, VSX (Traditional)

Version: R80.10 (EOS), R80.20 (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20

Last Modified: 2024-03-13

Symptoms

• Running the "cpstop" command on the Standby cluster member in a ClusterXL / VSLS cluster causes an outage of a Site to Site VPN on the Active cluster member.
• While all Check Point services are stopped on the Standby cluster member, the Active cluster member does not establish a Site to Site VPN and keeps sending the Tunnel Test packets.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 43
• Jumbo Hotfix Accumulator for R81.10 starting from Take 131
• Jumbo Hotfix Accumulator for R81 starting from Take 89
• Jumbo Hotfix Accumulator for R80.40 starting from Take 211

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General

Status: Approved by TAC

Date Created: 2020-10-14

Last Modified: 2024-03-13