> Source: [sk121096](https://support.checkpoint.com/results/sk/sk121096)

# sk121096 - How to configure a cluster between locally managed SMB appliances 

| Property | Value |
|----------|-------|
| Solution ID | sk121096 |
| Date Created | 2017-10-25 |
| Last Modified | 2023-12-26 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 6, 20, 400, 1570R, 110, 1500, 1600, 1800, 1595R, 910 |

## Solution

On SMB appliances, the cluster can be configured only in High Availability mode. This means that only one Gateway is active and that when there is a failover, the standby member becomes active.

* Both appliances must have the same hardware and firmware version.

<!-- -->

* Both appliances must have different names.

<!-- -->

* The secondary appliance must not have any configuration. The only configuration should be on the hardware level (if a LAN interface is configured on the Active member, then the same Port should be configured on the Standby member).

<!-- -->

* Connect a sync cable between the appliances on the sync port (Default: LAN2 port).

<!-- -->

* Connect both of the appliances' LANs (for example LAN1 from each appliance) to the same switch (to have the same Network Segment).

<!-- -->

* Reinitialize the internal VPN certificate on each appliance to obtain the external IP address for the CRL Distribution, e.g., http://10.10.10.1:18264/...

<!-- -->

* Bridge/switch configurations are currently not supported in a cluster configuration. Supported in R80.20.25 and higher, [sk171824](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171824&partition=Basic&product=Quantum). If any such configuration exists, delete it before you start configuring the cluster in **WebUI** -\> **Device** -\> **Local Network** :  

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-11710260540.PNG)

### On the Primary Member

1. Start the wizard on the primary member: Enter **WebUI, Device** -\> **High Availability** and click on **Configure Cluster**.

2. Choose the **Configure as primary member** option:

![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-21710260541.PNG)

3. Enter the password for initializing the cluster.

4. In the next window, configure the network settings according to the image below:

* Cluster IP address (VIP)
* Primary IP address (LAN1 address of the primary appliance)
* Secondary IP address (LAN1 address of the secondary appliance)   

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-31710260541.PNG)

5. For each Port/Network in the cluster, repeat step 4.

6. Once complete, click on **Finish**.

### On the Secondary Member

1. Start the wizard on the secondary member: Enter **WebUI, Device** -\> **High Availability** and click on **Configure Cluster**.

2. Choose the **Configure as secondary member** option:

![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-41710260542.PNG)

3. Enter the same password for initializing the cluster.

4. Click on **Establish Trust**:

![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-51710260543.PNG)

5. Click on**Finish** . The confirmation notification will appear, letting you know that this appliance will be the secondary cluster member. Click on **Yes**.

![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-61710260544.PNG)

* The secondary member will appear with only one button in the panel: **Device** .

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-71710260544.PNG)

<!-- -->

* The primary member will appear as below: ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-91710260546.PNG)

<!-- -->

* To verify that the cluster configuration has been successfully established, run the below commands from SSH (Expert mode): '*cphaprob state* ' and '*cphaprob --l list* '   

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-101710260546.PNG)

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/cphaprob -l1710250018.PNG)
* You can also click on **view diagnostics:**   

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-121710260547.PNG)
* **Note** : To make the best use of the cluster, it is recommended to configure the Internet connection according to the below configuration (if there are three Internet lines):

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-131710260547.PNG)
* To check the failover, click on **Force Member Down** on the primary member. The secondary member (which was on 'Standby' mode) should become the 'Active' appliance:  

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics//sk121096/sk121096-141710260548.PNG)

  **Note** : The Internet connections (**Static IP**\] should be configured on each Internet interface \[WAN/DMZ\], and another Static IP for the VIP.

  ### Troubleshooting:

  Run the following commands from expert mode:
  1. '*fw debug sfwd on TDERROR_ALL_ALL=5'*on both members. It is critical that you run this command at the same time.
  2. Create a rule, or re-establish trust, or run *'fw sic_test -p 10.231.149.2*' from the primary member.
  3. '*fw debug sfwd off TDERROR_ALL_ALL=5'* on both members to turn it off.
  4. Collect the debugs from *$FWDIR/log/sfwd.elg* from both members.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content