> Source: [sk180531](https://support.checkpoint.com/results/sk/sk180531)

# sk180531 - Cluster in High Availability mode fails to establish data connection with FTP server through VPN tunnel

| Property | Value |
|----------|-------|
| Solution ID | sk180531 |
| Date Created | 2023-01-25 |
| Last Modified | 2024-03-13 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * When an administrator connects a cluster to an FTP server through a VPN tunnel, the cluster establishes a control connection with the FTP server. However, the data connection fails.
* The cluster is in High Availability mode with Hide Active Only or Silent Standby Mode enabled.  
  Indication that Hide Active Only is enabled: the value of `fw ctl get int fwha_cluster_hide_active_only` is `1`   
  Indication that Silent Standby Mode is enabled: the the value of `fw ctl get int fwha_silent_standby_mode` is `1`.
* `fw monitor` on a Standby cluster member shows a packet from the data connection between the cluster and the FTP server. This is the only packet that appears for the Standby cluster member.
* `# fw ctl zdebug -m cluster + correction` on the Standby cluster member shows that the data connections packets are not flagged for correction. Example:   
  `@;12852;[vs_0];[tid_2];[fw4_2];fwha_ccl_send_via_active: &ltdir 1, 178.100.200.253:47304 -> 172.200.190.200:49687 IPP 6> is not flagged for correction; `

## Cause

When the Standby cluster member opens a data connection, it sends packets to the FTP server through the Active member. After a few seconds, the Standby member stops sending packets to the FTP server through the Active member. Instead, the Standby member attempts to send the packets from its own physical interfaces. This connection fails.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 43
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 113
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 89
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content