CloudLabBox
Try the free demo

Check Point CCSE lab 2 of 10

Cluster states and failover: fix a broken member

A change window has left the cluster unable to survive a failure, and the Active member is the only thing keeping the office online. Read cluster states, problem notifications and sync health, find three separate faults on GW2, fix them, and prove the repair with a failover that a TCP session survives.

Run this lab

It needs Professional: its 6 nodes are set to 11 vCPU and 19,456 MB in total.

In your workspace: Shared, then Check Point CCSE guided labs, then 02 - Cluster states and failover - fix a broken member

Run it on Professional from £7.50 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 11 vCPU and 19,456 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 100 minutes
Nodes need
11 vCPU, 19,456 MB
Smallest plan
Professional

The scenario

The network team made some changes to GW2 during a maintenance window. They left notes that say only "GW2 taken out for testing, put back when done". This morning the office is online, but your monitoring has flagged the cluster. Your job is to find out how exposed Northgate is, find everything that's wrong with GW2, and fix it.

You're done when GW2 can carry the office's traffic on its own, and you've proved that with a real failover. The design is the one from lab 1:

NetworkInterfaceVirtual addressGW1GW2
HQ-LAN 10.0.0.0/24eth010.0.0.10010.0.0.11110.0.0.112
Internet 67.83.0.0/24eth167.83.0.10067.83.0.11167.83.0.112
Sync 192.168.100.0/24eth2none192.168.100.1192.168.100.2

Both members use the provider, 67.83.0.113, as their default gateway. Don't take GW1 out of service until you've repaired GW2: for now it's the only member passing traffic.

What you’ll practise

  • Read cluster member states, including DOWN and ACTIVE(!)
  • Use cphaprob list to find which problem notification (pnote) is holding a member down
  • Explain permanent administrative down and find it in cphaprob.conf
  • Tell a sync failure from a monitored-interface failure
  • Explain why a healthy-looking member can still drop traffic after a failover
  • Prove state synchronisation with a TCP session that survives a failover

The tasks

  1. Assess the cluster
  2. Find what's holding GW2 down
  3. Find the sync fault
  4. Don't trust the state alone
  5. Prove it with a TCP session

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Cluster states and failover - fix a broken member6 nodes and 3 networks, 10 links. Every link is listed as text below the diagram.SMSGW1GW2ISPHQ-PCADMIN-PCHQ-LANInternetSyncGi0/0eth0eth0eth2eth1eth0eth0eth2eth0eth1
6 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • SMS eth0 to HQ-LAN (network)
  • GW1 eth0 to HQ-LAN (network)
  • GW2 eth0 to HQ-LAN (network)
  • GW1 eth1 to Internet (network)
  • GW2 eth1 to Internet (network)
  • GW1 eth2 to Sync (network)
  • GW2 eth2 to Sync (network)
  • HQ-PC eth0 to HQ-LAN (network)
  • ADMIN-PC eth0 to HQ-LAN (network)
  • ISP Gi0/0 to Internet (network)
Nodes in Cluster states and failover: fix a broken member, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
SMSCheck Point Security Management Servercpsms-R81.20-Licensed4 vCPU, 8,192 MB
GW1Check Point Security Gateway VE (cpsg template)cpsg-R81.20-Licensed2 vCPU, 4,096 MB
GW2Check Point Security Gateway (cpsg2 template)cpsg2-R81.20-Licensed2 vCPU, 4,096 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
HQ-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ADMIN-PCEVE-NG Firefox browser (Docker)eve-firefox:latest1 vCPU, 2,048 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Check Point CCSE guided labs.

  3. Open 02 - Cluster states and failover - fix a broken member and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Check Point CCSE labs

All Check Point CCSE labs

Related labs in other courses

CloudLabBox is independent of Check Point and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.