> Source: [sk169672](https://support.checkpoint.com/results/sk/sk169672)

# sk169672 - GRE traffic fails to pass through a cluster after all cluster members are rebooted

| Property | Value |
|----------|-------|
| Solution ID | sk169672 |
| Date Created | 2020-09-26 |
| Last Modified | 2021-07-06 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Symptoms

- In a cluster with GRE configured over a Cluster Virtual IP:

* GRE traffic fails to pass after all cluster members are rebooted at the same time.

* Traffic capture shows that GRE traffic uses the IP address of a physical cluster interface instead of the Cluster Virtual IP to encapsulate the traffic.

## Cause

While the cluster members reboot, the Cluster Virtual IP address is not available.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416)

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

<br />

If you choose not to upgrade, as a **Workaround:**

1. Connect to the command line to each cluster member.

2. Log in to the Expert mode.

3. Examine the cluster state of all cluster members.

   *cphaprob state*
4. On the Active cluster member, get the list of all GRE connections:

   *fw tab -t connections \| grep "0000002f;"*

   Each connection is represented by 6 hexadecimal numbers followed by a semicolon, followed by additional numbers:

   *\<Direction\>, \<Source IP Address\>, \<Source Port\>, \<Destination IP Address\>, \<Destination Port\>, \<IP Protocol = 0000002f\>; ...*
5. Convert the parameters of the problematic GRE connection to hexadecimal numbers.

   Locate the problematic GRE connection in the list of all GRE connections.
6. Copy the first 6 hexadecimal numbers of the problematic GRE connection to a plain text editor (for example, Notepad).

   Example:

   `00000001, 64000001, 00000000, 32000002, 00000000, 0000002f`
7. In plain text editor, prepare the syntax to delete the problematic GRE connection (there are no spaces between the numbers):

   *fw tab -t connections -x -e "\<Direction\>,\<Source IP Address\>,\<Source Port\>,\<Destination IP Address\>,\<Destination Port\>,0000002f"*

   Example:

   `fw tab -t connections -x -e "00000001,64000001,00000000,32000002,00000000,0000002f"`
8. On the Active cluster member, delete the problematic GRE connection:

   *fw tab -t connections -x -e "\<Direction\>,\<Source IP Address\>,\<Source Port\>,\<Destination IP Address\>,\<Destination Port\>,0000002f"*
9. On other cluster members, delete the problematic GRE connection:

   *fw tab -t connections -x -e "\<Direction\>,\<Source IP Address\>,\<Source Port\>,\<Destination IP Address\>,\<Destination Port\>,0000002f"*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content