> Source: [sk181836](https://support.checkpoint.com/results/sk/sk181836)

# sk181836 - How to Troubleshoot Cloud Firewall Health Check Probes 

| Property | Value |
|----------|-------|
| Solution ID | sk181836 |
| Date Created | 2023-12-26 |
| Last Modified | 2026-04-28 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| Platform | AWS, Azure, GCP |

## Solution

Introduction
------------

The Health Check probe confirms that a specific service on the server runs and performs its work successfully.

In cloud environments like Azure, AWS, and GCP, we configure load balancers to send Health Check probes to the Cloud Firewall (formerly CloudGuard Network) Gateways at intervals to find which Security Gateway it can direct traffic to.

In R81.10, Check Point introduced a CP Agent (Health Probe Agent) for AWS, GCP, and Azure.

The Health Probe Agent is part of Azure Cluster, Virtual Machine Scale Sets (VMSS) and Virtual WAN (vWAN) solutions, AWS Auto Scaling Group (ASG) R81.10 and higher, and Gateway Load Balancer (GWLB) solutions. The Health Probe agent lets you configure a Security Gateway to answer Health Probe requests, regardless of the security policy installed on the Security Gateway.  

**Note:** in a Cluster HA environment, only the active member answers to the probes.   

Troubleshooting
---------------

### Azure {#Azure}

**Show / Hide the section**   
<br />

#### General {#Azure1}

Azure's IP address for Health Probs is 168.63.129.16.  
The port differs based on the environment in use: VMSS or vWAN.

In Azure environments, the load balancer tries to establish a TCP handshake (SYN, SYN-ACK, ACK) with its back-end pool Virtual Machines (VMs) to monitor their health status.

**Parameter attribute table**

**Note:** If both the IP address and the port are zero, you must set the IP address **before** you set the port to enable the feature on the fly.

|--------------------------------|-----------------|-----------------------------------------------------------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| FW kern attribute name         | Mode/Input type | Description                                                                                   | Requires install policy | Comments                                                                                                                          |
| `cloud_balancer_use_ip_ranges` | 0               | The Security Gateway accepts Health Check only from cloud_balancer_ip1 and cloud_balancer_ip2 | Yes                     | Azure mode                                                                                                                        |
| `cloud_balancer_azure_mode`    | 0               | For VMSS environment                                                                          | Yes                     | Azure only                                                                                                                        |
| `cloud_balancer_azure_mode`    | 1               | For vWAN environment                                                                          | Yes                     | Azure only                                                                                                                        |
| `cloud_balancer_port`          | INT             |                                                                                               | No                      | Mandatory for all modes. Used to enable/disable the agent. When port ? 0, agent is enabled When port = 0, agent is disabled       |
| `cloud_balancer_port_eth0`     | INT             | Port for eth0 (connected to ELB)                                                              | No                      | Mandatory for Azure vWAN mode. Used to enable/disable the agent. When port ? 0, agent is enabled When port = 0, agent is disabled |
| `cloud_balancer_ip1`           | IP address      |                                                                                               | No                      | Mandatory for Azure mode                                                                                                          |
| `cloud_balancer_ip2`           | IP address      |                                                                                               | No                      | Optional for Azure mode                                                                                                           |

<br />

#### For VMSS solution:

The Health Probe agent on the Cloud Firewall Gateways listens on port 8117 for health probe calls from Azure's Health Probing IP (168.63.129.16).

The Agent replies to a SYN with a SYN-ACK, ignoring non-SYN packets (dropping them).

After installing a regular policy (not an Initial or Default policy), the agent replies to TCP on port 8117 from the 168.63.129.16 IP address.  

See port and Health Probing IP configuration parameters in the attribute table above. The default value for these parameters is 0. If any value is 0, the agent is not active.

#### For Virtual WAN (vWAN) solution:

In vWAN environments, the load balancer sends health probe calls from both sides to the two Network Interface Cards of the Security Gateway.

Currently, there is only an Internal Load Balancer (ILB).   
There is a plan to add an External Load Balancer (ELB).

**Important:** Adding support for *cloud_balancer_port_eth0* \& *cloud_balancer_azure_mode* parameters is supported in [R81.20](https://support.checkpoint.com/results/sk/sk173903) and in [Jumbo hotfix accumulator for R81.10 Take 82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/Introduction.htm) and higher.

The Health Probe agent on the Cloud Firewall Gateways listens to health probe calls from Azure's Health Probing IP address (168.63.129.16).  
The agent listens on port 8117 for probes to the internal interface (eth1) and on port 8118 for probes to the external interface (eth0).  
The agent ignores the health probe packets that the load balancers send to the opposite interfaces, as those calls are not necessary.

The Agent replies to a SYN with a SYN-ACK, ignoring non-SYN packets (dropping them).

After installing a regular policy (not an Initial or Default policy), the agent replies to TCP on port 8117/8118 from the 168.63.129.16 IP address.  

See configuration parameters in the attribute table above.  

The default value for these parameters is 0. If one of the values is 0, the agent is not active.

#### Common scenarios

* Scenario 1: Azure Gateway does not respond to health probes.  
  > **Symptoms**   
  >
  > * Cluster health shows no information in "Insight" in the Azure portal.
  > * `# fw ctl zdebug drop | grep 8117` shows that health probes are dropped on the rule base.
  > * `# fw ctl zdebug -m cluster cloud for a High Availability cluster `or  
  >   `# fw ctl zdebug highavail` for a VMSS cluster result in similar logs:  
  >   `@;3670439;[cpu_3];[fw4_0];fwlic_count_host: Not enforcing hosts (nhosts=0);`  
  >   `@;3670439;[cpu_1];[fw4_2];fwlic_count_host: Not enforcing hosts (nhosts=0);`  
  >   `@;3670439;[cpu_2];[fw4_1];fwlic_count_host: Not enforcing hosts (nhosts=0);`  
  >   `@;3670439;[cpu_1];[fw4_2];fwlic_count_host: Not enforcing hosts (nhosts=0);`
  > * The `$FWDIR/scripts/azure_ha_test.py` command does not show any issues.
  > * Running `# fw ctl zdebug -m cluster cloud` results in an empty output on the problematic VM.
  >
  > <br />
  >
  > <br />
  >
  > **Cause**   
  > Some configuration is missing in the Security Gateway's *$FWDIR/boot/modules/fwkern.conf* file to handle health probe packets.  
  >
  > **Solution**
  >
  > **Note:** This solution is applicable for all types of Check Point deployments in Azure; if a Check Point Cloud Firewall Gateway instance is part of a back-end pool of an Azure load balancer, you must apply this configuration, and the Azure Health-Check must be on port 8117.
  >
  > *$FWDIR/boot/modules/fwkern.conf* must have these parameters in order to work correctly:
  >
  > `cloud_balancer_ip1=0xa83f8110`  
  > `cloud_balancer_port=8117`
  >
  > If one of these parameters is missing:
  > 1. Back up the *$FWDIR/boot/modules/fwkern.conf* file:  
  >
  >    `#cp $FWDIR/boot/modules/fwkern.conf $FWDIR/boot/modules/fwkern.conf.bkp`
  >
  > 2. Open the *$FWDIR/boot/modules/fwkern.conf* file and add the missing parameter mentioned above.
  >
  > 3. Save the file with the new parameters.
  >
  > 4. Reboot the Security Gateway.
  >
  > 5. Apply to all other members in the cluster.
  >
  > 6. When the procedure is done, run these commands:
  >
  >    * For High Availability cluster: `# fw ctl zdebug -m cluster cloud`
  >    * For a VMSS cluster: `# fw ctl zdebug highavail`
  >
  >    The output must include similar logs:
  >
  >    `[cpu_x];[fwx_0];fwha_handle_cloud_probe_request: sending reply to 168.63.129.16 on eth0 (1);`  
  >    `[cpu_x];[fwx_1];fwha_handle_cloud_probe_request: sending reply to 168.63.129.16 on eth1 (2);`
* Scenario 2: Tcpdump on Azure Gateway external interface does not show Health Probe traffic.  
  > **Symptoms**   
  >
  > * TCPDUMP on Azure Gateway external interface does not show Health Probe traffic.
  > * TCPDUMP on the Gateway's internal interface does show Health Probe traffic.
  >
  > <br />
  >
  > **Cause**   
  >
  > * *External Load Balancer Health Probe Check for Instances:*   
  >
  >   The load balancer sends a packet that matches your deployment's front end and rule. The packet travels from the source to the host and arrives at a VM in the back-end pool. The load balancer infrastructure performs the same load balancing and translation operations as it does for all other traffic. This probe is in-band on your load-balanced endpoint. After the probe arrives on the compute host, where there is a healthy VM in the back-end pool, the compute host generates a response to the probing service. Your VM does not see this traffic.  
  >
  > * *Internal Load Balancer Health Probe Check for Instances:*   
  >
  >   The health probe status metric describes the health of your application deployment as you configure the health probe of your load balancer. The load balancer uses the status of the health probe to find where to send new flows. The Health Probes source is an Azure infrastructure address, and you can see it in the guest OS of the VM.  
  >
  > For more information refer to: [Standard load balancer diagnostics](https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics)  
  >
  > <br />
  >
  > **Solution**   
  > No fix is required. This behavior is by design.  
  >
  > <br />
  >
* Scenario 3: Cloud Firewall for Azure Gateway is dropping health probes.  
  > **Symptoms**   
  > These packet drops are observed on Azure Security Gateways when debugging for drops:  
  >
  > `@;289735852;[cpu_1];[fw4_0];fwha_handle_cloud_probe: dropping cloud probing request on eth1 (2);`  
  > `@;289735852;[cpu_1];[fw4_0];fwha_handle_cloud_probe: dropping cloud probing request on eth0 (1);`  
  >
  > **Cause**   
  > This behavior is by design.  
  >
  > The Firewall kernel replies to the Cloud load balancer Health Probe packets and drops the packets for performance considerations.  
  > As a result, the kernel level debugs show that the packets are dropped.
  >
  > <br />
  >
  > **Solution**   
  > This is an expected behavior: The drops are part of a performance consideration.  
  > To make sure certain health probe traffic is working correctly, run this command:  
  >
  > For HA cluster: `# fw ctl zdebug -m cluster cloud`  
  > For VMSS or a single Gateway: `# fw ctl zdebug highavail`

### AWS {#AWS}

**Show / Hide the section**   
<br />

#### General {#AWS1}

**Parameter attribute table**

**Note:** If both the IP address and the port are zero, you must set the IP address **before** you set the port to enable the feature on the fly.

|--------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| FW kern attribute name         | Mode/Input type | Description                                                                                                                   | Requires install policy | Comments                                                                                                                    |
| `cloud_balancer_use_ip_ranges` | 1               | The Security Gateway accepts Health Check from any IP address in the range cloud_balancer_ip1- cloud_balancer_ip2 (inclusive) | Yes                     | AWS mode                                                                                                                    |
| `cloud_balancer_port`          | INT             |                                                                                                                               | No                      | Mandatory for all modes. Used to enable/disable the agent. When port ? 0, agent is enabled When port = 0, agent is disabled |
| `cloud_balancer_ip1`           | IP address      |                                                                                                                               | No                      | Mandatory for AWS mode                                                                                                      |
| `cloud_balancer_ip2`           | IP address      |                                                                                                                               | No                      | Mandatory for AWS mode                                                                                                      |

<br />

1. Make sure that the Health Probe agent configuration is correct:

   Open the *$FWDIR/boot/modules/fwkern.conf* file and validate the Health Check IP range parameters: cloud_balancer_ip1 and cloud_balancer_ip2

   (ip1 and ip2 are the first and last IP address range respectively)

   **Note:** Health Check IP range in *fwkern.conf* is in hexadecimal format.

   For example:

   `cloud_balancer_ip1=0x0a000a00`  
   `cloud_balancer_ip2=0x0a0014ff`
2. For Application and Network Load Balancers:

   The Health Probe packet goes from external load balancer to the edge destination (for example Web Server, Application Server).
3. Run this debug command to identify issues:

   For HA cluster: `# fw ctl zdebug -m cluster cloud`  
   For VMSS or a single Gateway:` # fw ctl zdebug highavail`

### GCP {#GCP}

**Show / Hide the section**   
<br />

#### General {#GCP1}

<br />

**Parameter attribute table**

**Note:** If both the IP address and the port are zero, you must set the IP address **before** you set the port to enable the feature on the fly.

|--------------------------------|-----------------|--------------------------------------------------------------------------------------------------------------------|-------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| FW kern attribute name         | Mode/Input type | Description                                                                                                        | Requires install policy | Comments                                                                                                                    |
| `cloud_balancer_use_ip_ranges` | 2               | The Security Gateway accepts Health Check from the IP ranges configured in the Management server's *user.def* file | Yes                     | GCP mode                                                                                                                    |
| `cloud_balancer_port`          | INT             |                                                                                                                    | No                      | Mandatory for all modes. Used to enable/disable the agent. When port ? 0, agent is enabled When port = 0, agent is disabled |

<br />

1. Make sure that the Health Probe agent configuration is correct:

   The port configuration is the same port parameter as in Azure. To see the parameter, run the command:

   `# fw ctl get int cloud_balancer_port `

   The correct output is:

   `cloud_balancer_port 8117`
2. Add the GCP IP ranges to the *cloud_balancer_ips* table in the Security Management server's *$FWDIR/conf/user.def.FW1* and $FWDIR/conf/user.def.R8120CMP files.  

   **Important:** As the source probes in GCP are IP ranges and not a specific IP address, you cannot use the *cloud_balancer_ip1* parameter.

   GCP IP ranges are: 35.191.0.0/16, 209.85.152.0/22, 209.85.204.0/22, 130.211.0.0/22.

   To use IP ranges, create a subnets table in the Security Management server. The subnets are transferred to the Security Gateway on the policy installation.

   For example:

   `cloud_balancer_ips = {`  
   `<35.191.0.1, 35.191.255.254>,`  
   `<209.85.152.1, 
   209.85.155.254>,`  
   `<209.85.204.1, 209.85.207.254>,`  
   `<130.211.0.1, 130.211.3.254>`   
   `};`

   **Note:** On Multi-Domain Security Management Server, the relevant *user.def.X* file is in the Customer/Domain that manages the relevant Security Gateway/Cluster.  
   The path starts with *$MDSDIR/customers/\<Name of Domain Management Server that manages the Security Gateway\>/CPsuite-Rxx/fw1/conf* /.   

   As an alternative you can edit this file in the context of the applicable Domain.  
   To go to the required context, use the command:  
   `# mdsenv <IP Address or Name of the Domain>`  

   For more information, refer to [R81.20 Quantum Security Management Administration Guide](https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityManagement_AdminGuide/Content/Topics-SECMG/Configuring_Implied_Rules_or_Kernel_Tables_for_Security_Gateways_user.def.htm)
3. To check the *cloud_balancer_ips* table on the Security Gateway after the policy installation, use the command:

   `# fw tab -t cloud_balancer_ips`

   **Note:** The IP addresses in the output are in hexadecimal format.

   To make sure the IP ranges are in use, run the command:

   `# fw ctl get int cloud_balancer_use_ip_ranges `

   The expected output is:

   `cloud_balancer_use_ip_ranges 2`
4. Make sure that the configuration is correct if the destination IP addresses are not the Gateways IP addresses.

   **Note:**external TCP load balancers in GCP send probes when the source IP is from GCP ranges, and the destination is the load balancer public IP address (the destination is not the Security Gateways external private IP address).

   Use this command for the verifications:

   `# fw ctl get int cloud_balancer_allow_any_dst`

   The expected output is:

   `cloud_balancer_allow_any_dst 1`
5. Make sure that policy installation completes successfully.

6. Run this debug command to identify issues:

   For HA cluster: `# fw ctl zdebug -m cluster cloud`  
   For VMSS or a single Gateway: `# fw ctl zdebug highavail`
7. Make sure that all the parameters are present in *$FWDIR/boot/modules/fwkern.conf*

   For example:

   `# cat $FWDIR/boot/modules/fwkern.conf`

   `cloud_balancer_port=8117`  
   `cloud_balancer_use_ip_ranges=2`  
   `cloud_balancer_allow_any_dst=1`

<br />

Known Limitation
----------------

* Activating Anti-Spoofing on the internal Network Interface Card is not supported.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content