> Source: [sk183577](https://support.checkpoint.com/results/sk/sk183577)

# sk183577 - Split-Brain behavior in ClusterXL when the Sync interfaces are connected through a Layer 3 device

| Property | Value |
|----------|-------|
| Solution ID | sk183577 |
| Date Created | 2025-06-17 |
| Last Modified | 2025-07-10 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Traffic does not pass through the Cluster.

* The "`cphaprob state`" command on each Cluster Member shows that each Cluster Member reports itself as "Active" and reports it peer Cluster Member as "Down".

* Output of the Expert mode command "`cphaprob tablestat`" shows MAC addresses that do not belong to the relevant cluster interfaces.

* Kernel debug (`fw ctl zdebug -m cluster + ccp`) shows that CCP packets between the cluster members arrive with a TTL value smaller than the required value of 255.

  Example:

  `;fwhamultik_handle_ccp: CCP recognized;`  
  `
  ;fwhamultik_handle_ccp: CCP non-sync packet, forwarding to cluster instance (id 1);`  
  `
  ;fwha_receive_fwhap_msg: CCP packet TTL value is 254 instead of 255;`

## Cause

A Layer 3 device is connected between the affected cluster interfaces.

ClusterXL design does not support Layer 3 devices between cluster members.

To validate that CCP packets are not injected from an outside network, the Extended Cluster Anti-Spoofing protection checks that the TTL in the CCP packets is exactly 255 (i.e., CCP packets did not pass through any router that are required to decrease the TTL value). If the TTL value in the CCP packets is smaller than 255, the Extended Cluster Anti-Spoofing protection drops them.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content