> Source: [sk179005](https://support.checkpoint.com/results/sk/sk179005)

# sk179005 - Support for connections from Data Interface to the Management Interface and from the Management Interface to Data Interfaces in Scalable Platforms

| Property | Value |
|----------|-------|
| Solution ID | sk179005 |
| Date Created | 2022-07-13 |
| Last Modified | 2023-05-28 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81.20, R81.10 (EOS) |
| OS | Gaia |

## Solution

### Introduction

The feature described in this article ("Connections from Data to Management Interfaces, and from Management to Data Interfaces") resolves these limitations (see [sk148074](https://support.checkpoint.com/results/sk/sk148074)):

* SPC-1111 - Connections that arrive at the Management Interface and are sent out through the Data Interface are not supported.
* SPC-1104 - Connections that arrive at the Data Interface and are sent out through the Management Interface are not supported.

Support for this feature starts in R81.10:

|------------------|--------------------------------|---------------------------------|
| Version          | Behavior                       | Kernel Parameter Value          |
| R81.20 and above | Feature is enabled by default  | `fwha_data_mgmt_connection = 1` |
| R81.10           | Feature is disabled by default | `fwha_data_mgmt_connection = 0` |

This feature does not have an effect on Data-to-Data connections or local connections (connections that are established by the Security Group Members).

In general, traffic that goes through the Management Interface is not synchronized with the backup Security Group Members because packets that go through the Management Interface always arrive at and are handled by the Single Management Object (SMO). Therefore, if backup Security Group Members are calculated based on DXL, a single failover causes a connection drop, if the connection was not properly synchronized in advance with the new SMO.  

This feature supports a smart synchronization of these connections with SGMs that may be the new SMO, therefore allowing the connection to be properly handled or corrected by the SMO, and to survive when member failover and site failover occur.

### Synchronization

When you enable this feature, the Data-to-Management and Management-to-Data connections are synchronized like this:

|-------------------------------|-------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|
| Connection Flow               | Selection of Security Group Members for Client-to-Server connections                                                    | Selection of Security Group Members for Server-to-Client connections                                                    |
| Data-to-Management Interfaces | Calculated based on the DXL matrix                                                                                      | * SMO * Second active Security Group Member on the Active Site * First active Security Group Member on the Standby Site |
| Management-to-Data Interfaces | * SMO * Second active Security Group Member on the Active Site * First active Security Group Member on the Standby Site | Calculated based on the DXL matrix                                                                                      |

### Example

A Dual-Site environment with three Security Group Members on each Site.

The active Security Group Members are:

* 1_1 (SMO), 1_3, 1_4 (Active Site)
* 2_1, 2_2, 2_3 (Standby Site)

Running a Data-to-Management connection (where the inbound interface is Data and the outbound interface is Management) results in synchronization with these Security Group Members:

* Security Group Members for Client-to-Server connections:
  * According to the normal DXL matrix calculation (for example: 1_1, 1_4, and 2_3)
* Security Group Members for Server-to-Client connections:
  * According to the Data to Management smart synchronization: 1_1 (SMO), 1_3 (the second active Security Group Member on the Active Site) and 2_1 (the first active Security Group Member on the Standby Site)

The connection is synchronized with Security Group Members: 1_1, 1_3, 1_4, 2_1, and 2_3.

### Configuration

**Important** - In R81.20 and above, this feature is enabled by default. In R81.10, this feature is disabled by default.

1. Connect to the command line on the Security Group.

2. Run the applicable command:

   |----------------------------------------------------------------------------------------------------------|-------------|------------------------------------------------------|
   | Action                                                                                                   | Shell       | Syntax                                               |
   | Get the current feature status * 0 = disabled * 1 = enabled                                              | Gaia gClish | `fw -a ctl get int fwha_data_mgmt_connection`        |
   | Get the current feature status * 0 = disabled * 1 = enabled                                              | Expert mode | `g_fw -a ctl get int fwha_data_mgmt_connection`      |
   | Enable the feature **temporarily** (does not survive reboot)                                             | Gaia gClish | `fw -a ctl set int fwha_data_mgmt_connection 1`      |
   | Enable the feature **temporarily** (does not survive reboot)                                             | Expert mode | `g_fw -a ctl set int fwha_data_mgmt_connection 1`    |
   | Enable the feature **permanently** (survives reboot) Important - This is the default in R81.20 and above | Gaia gClish | `fw -a ctl set -f int fwha_data_mgmt_connection 1`   |
   | Enable the feature **permanently** (survives reboot) Important - This is the default in R81.20 and above | Expert mode | `g_fw -a ctl set -f int fwha_data_mgmt_connection 1` |
   | Disable the feature **temporarily** (does not survive reboot)                                            | Gaia gClish | `fw -a ctl set int fwha_data_mgmt_connection 0`      |
   | Disable the feature **temporarily** (does not survive reboot)                                            | Expert mode | `g_fw -a ctl set int fwha_data_mgmt_connection 0`    |
   | Disable the feature **permanently** (survives reboot) Important - This is the default in R81.10          | Gaia gClish | `fw -a ctl set -f int fwha_data_mgmt_connection 0`   |
   | Disable the feature **permanently** (survives reboot) Important - This is the default in R81.10          | Expert mode | `g_fw -a ctl set -f int fwha_data_mgmt_connection 0` |

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content