> Source: [sk180645](https://support.checkpoint.com/results/sk/sk180645)

# sk180645 - ClusterXL failover on Azure HA causes an outage

| Property | Value |
|----------|-------|
| Solution ID | sk180645 |
| Date Created | 2023-02-20 |
| Last Modified | 2026-05-11 |
| Technical Level | Advanced |
| Products | Cloud Firewall |
| Versions | R82.10, R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | Azure |

## Symptoms

- * Executing `"clusterXL_admin down"` on the Active member of Azure HA environment causes an outage, although the Standby member successfully turns to Active.

* After the failover on the ClusterXL side - you can see with `tcpdump/cppcap` that open connections continue to reach the previous Active member and not to the new Active or do not reach the members at all.

* Refreshing the Azure website for eth0's VIP on the previous Active member reveals the VIP is not anymore related to the interface after 8-20 seconds from the failover execution. On the new Active member, the VIP is related to eth0 only after about 2 minutes.

* VPN is not configured in the environment.

* Running the script: *$FWDIR/scripts/azure_ha_test.py* passes successfully with no issues.

* There are no drops on port 8117 or port 8116, and the output of `"fw ctl zdebug -m cluster cloud"` shows that the two Cluster members send the correct health probes to the Load Balancer after the failover.

## Cause

The default route is the Cluster VIP and not the Load Balancer IP.

When an Azure ClusterXL fails over, the VIP is not affined to a Cluster member for about two minutes until it is re-associated to the 2nd member's eth0 interface. Traffic sent to the VIP is not transformed or answered during this time.

When the environment uses VPN, it is required to set the VPN tunnel directly to the Active member's IP (VIP). Therefore - there is no other option besides configuring the VIP of the ClusterXL as the default route for the network, which leads to a scenario where the failover can take a maximum of 2 minutes until the VIP is re-associated with the new Active Cluster member eth0 interface.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content