> Source: [sk170163](https://support.checkpoint.com/results/sk/sk170163)

# sk170163 - Cluster Active-Active: connection is dropped when it is moved from one ACTIVE member to another

| Property | Value |
|----------|-------|
| Solution ID | sk170163 |
| Date Created | 2021-02-03 |
| Last Modified | 2022-04-12 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Cause

<br />

## Solution

### Background

Active-Active mode, enables to distribute network traffic between cluster members, in contrast to High Availability, where only a single member is active at any given time.

All cluster members are active in Active-Active mode, connections can move from one member to another based on traffic decision.

Long connection might be deleted from connection table, when connection is move from one Active member to another Active member, and after some time the connection is disconnected.

### Cause

Due to infrastructure changes, the timeout of connection is updated by the connection owner (i.e the first Active member that handle the connection), therefore when the owner is still Active but the connection has moved to another Active member that starts to handle this connection, it does not update the timeout.

As a result when the timeout is expired in the first Active member (owner) it delete the connection and sync it to all cluster members.

### Solution

This problem was fixed. The fix is included in:

* [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

For R80.40, install [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) Take 91 or higher.

**Note:** There is a risk that the cluster sync will break until both members will run with the same value for the below global parameter.

Follow the below instructions carefully:

1. Schedule a maintenance window.

2. Add the following line to the $FWDIR/boot/modules/fwkern.conf on all cluster members:

   `cphwd_pkt_delta_active_active_enable=1`
3. Reboot the first cluster member.

4. Wait until the first member is up in ACTIVE! ; Down state, then reboot the other members.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content