> Source: [sk105864](https://support.checkpoint.com/results/sk/sk105864)

# sk105864 - Traffic does not pass correctly after ISP Redundancy failover when Gaia OS Cloning Group is configured

| Property | Value |
|----------|-------|
| Solution ID | sk105864 |
| Date Created | 2015-04-27 |
| Last Modified | 2025-01-24 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Traffic does not pass correctly after ISP Redundancy failover (due to the current ISP Link going down).

* Output of the "`ip route get <Destination_IP_Address>`" command (in the Expert mode) shows that the nexthop default gateway did not change to that of new active ISP Link (i.e., nexthop default gateway of the failed IPS Link is still used).

## Cause

Default Gateway in the ISP Redundancy configuration does not change upon ISP Link failure on Security Gateway / Cluster when a Gaia OS Cloning Group is configured.

1. When an ISP Link is down, the `$FWDIR/bin/cpisp_update` script tries to reconfigure the nexthop default gateway by running the Gaia Clish commands like "*set static-route default nexthop gateway address...*".
2. When a Gaia OS Cloning Group is configured, this command fails:  
   *CLINFR0699 This command belongs to a cloning group synchronized feature and therefore cannot be executed in normal mode.*

## Solution

### Code was improved (requires manual configuration):

> The `$FWDIR/bin/cpisp_update` script will check if a Gaia OS Cloning Group is configured, and if it is, then the script will not use the Gaia Clish command, but the Expert mode commands "`ip route`" commands to set the new nexthop default gateway.

### Important Notes:

* You must enable the Gaia OS feature "Kernel Routes" to allow ISP Redundancy to add routes directly to the Gaia OS kernel (see the procedure below).
* In a cluster environment, you must configure all cluster members in the same way.

### Instructions to enable the "Kernel Routes" feature in Gaia OS R80.10 and higher

> 1. Connect to the command line on the Security Gateway / each ClusterXL Member.
>
> 2. Log in to Gaia Clish.
>
> 3. Enable the "Kernel Routes" feature:
>
>    ***set kernel-routes on***
> 4. Save the changes:
>
>    ***save config***
> 5. Log in to the Expert mode.
>
> 6. Verify that the feature was enabled:
>
>    ***grep "kernel:options" /config/db/initial***
>
>    Output should show:  
>    `routed:instance:default:kernel:options routes`

### Instructions to enable the "Kernel Routes" feature in Gaia OS R75.40 - R77.30

> Show / Hide this section  
> 1. Enable the "Kernel Routes" feature:
>
>    1. Connect to the command line on the Security Gateway / each ClusterXL Member.
>
>    2. Log in to Gaia Clish.
>
>    3. Enable the feature:
>
>       ***set kernel-routes on***
>    4. Save the changes:
>
>       ***save config***
>    5. Log in to the Expert mode.
>
>    6. Verify that the feature was enabled:
>
>       ***grep "kernel:options" /config/db/initial***
>
>       Output should show:  
>       `routed:instance:default:kernel:options routes`
> 2. Install the required hotfix:
>
>    1. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.
>
>       A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
>       For faster resolution and verification, collect these files:
>       1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
>       2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.
>    2. Install the hotfix:
>
>       * On a **Security Gateway / ClusterXL Members** running Gaia OS R75.40 and above:
>
>         1. Install the [latest build of the CPUSE Agent](https://support.checkpoint.com/results/sk/sk92449).
>
>         2. Install the hotfix as described in the [CPUSE Administration Guide](https://sc1.checkpoint.com/documents/CPUSE/Default.htm).
>
>            **Note:** Reboot is required.
>
>         You can also use the [sk111158 - Central Deployment Tool (CDT)](https://support.checkpoint.com/results/sk/sk111158) to install this hotfix on Security Gateways / ClusterXL Members.
>       * On a **VSX Gateway / VSX Cluster Members** running Gaia OS R75.40VS - R77.30:
>
>         Note: You must be connected either over Console, or LOM card (SSH session could be disconnected). On VSX versions R75.40VS - R77.30, the Gaia CPUSE does not support installation of hotfixes.
>         1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*).
>
>         2. Unpack and install the hotfix package:
>
>            ***\[Expert@HostName\]# cd /some_path_to_fix/***   
>            ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\<HOTFIX_NAME\>.tgz***   
>            ***\[Expert@HostName\]# ./fw1_wrapper_\<HOTFIX_NAME\>***
>            **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen.
>         3. Reboot the VSX Security Gateway / each VSX Cluster Member.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content