http://www.cpwiki.net/index.php?action=history&feed=atom&title=Cpha_status_%2F_cphaprob_stat_down_problem
Cpha status / cphaprob stat down problem - Revision history
2026-04-29T09:47:52Z
Revision history for this page on the wiki
MediaWiki 1.21.10
http://www.cpwiki.net/index.php?title=Cpha_status_/_cphaprob_stat_down_problem&diff=20&oldid=prev
Nighthawk: Pushed from Themanclub.
2013-02-25T22:55:10Z
<p>Pushed from Themanclub.</p>
<p><b>New page</b></p><div>== Problem Description ==<br />
1) '''cphaprob stat''' shows the partner firewall status is down on BOTH nodes of an HA pair.<br />
<br />
'''Example:'''<br />
firewall-1[admin]# '''cphaprob stat'''<br><br />
Cluster Mode: Sync only (IPSO cluster)<br><br />
Number Unique Address Firewall State (*)<br><br />
1 (local) 10.10.30.2 Active<br />
2 10.10.30.3 Down<br />
<br />
2) fw ctl pstat shows zero packets recieved on BOTH nodes<br />
<br />
Example:<br />
firewall-2[admin]# '''fw ctl pstat|grep -C 1 Sync'''<br><br />
Sync:<br />
Version: new<br />
Status: Able to Send/Receive sync packets<br />
Sync packets sent:<br />
total : 326990, retransmitted : 0, retrans reqs : 0, acks : 0<br />
Sync packets received:<br />
total : 0, were queued : 0, dropped by net : 0<br />
<br />
3) tcpdumps on the sync interface only show OUTBOUND packets, no INBOUND packets (2nd field O=outbound packet)<br />
<br />
23:46:26.358170 O 00:00:00:00:fe:00 (oui XEROX CORPORATION) > 01:00:5e:0a:1e:fa (oui Unknown), ethertype NOK sync (0x7005), length 78: CPHA 0.0.0.0.8116 > 10.10.30.0.8116: ifc 0 smach 0 dmach 65534 op ifc-cfg-resp <br />
<br />
23:46:26.358173 O 00:00:00:00:fe:00 (oui XEROX CORPORATION) > 01:00:5e:0a:1e:fa (oui Unknown), ethertype NOK sync (0x7005), length 78: CPHA 0.0.0.0.8116 > 10.10.30.0.8116: ifc 0 smach 0 dmach 65534 op ifc-cfg-resp <br />
<br />
23:46:26.459135 O 00:00:00:00:fe:00 (oui XEROX CORPORATION) > 01:00:5e:0a:1e:fa (oui Unknown), ethertype NOK sync (0x7005), length 218: CPHA 0.0.0.0.8116 > 10.10.30.0.8116: ifc 0 smach 0 dmach 65534 op new-sync <br />
<br />
4) Sync mode set to multicast<br />
crx-dev1[admin]# '''cphaprob -a if'''<br><br />
eth4c0 sync(secured), broadcast<br />
eth2c1 non sync(non secured)<br />
eth2c0 non sync(non secured)<br />
eth3c0 sync(secured), broadcast<br />
eth1c1 non sync(non secured)<br />
<br />
== Possible Causes: ==<br />
<br />
Switch problem, physical NIC / cabling problem.<br />
<br />
<br />
== Solution: ==<br />
<br />
for this case... the sync mode was changed from multicast to broadcast <br />
<br />
firewall-1[admin]# '''cphaconf set_ccp broadcast'''<br />
<br />
run "cphaprob stat" again and it will show active/active if this fix worked.<br />
[[category:check point]]</div>
Nighthawk