> Source: [sk184146](https://support.checkpoint.com/results/sk/sk184146)

# sk184146 - OSPF over Virtual Tunnel Interface (VTI) goes down on Active Cluster Gateway after running cpstop or cphastop on the Standby Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk184146 |
| Date Created | 2025-10-07 |
| Last Modified | 2026-07-16 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- Running `"cphastop"` or `"cpstop"` on ClusterXL Standby Security Gateway causes OSPF over VTI to go down on the Active Gateway.

## Cause

When `cphastop` or `cpstop` are run on the Standby member, it continues to send ESP packets even though the parameter *fwha_silent_standby_mode* is enabled. The Active member continues sending ESP packets without updating the replay counter, causing a replay counter drop.

## Solution

<br />

1. [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
   The fix prevents the Standby Member from sending ESP packets after running on it `cphastop` or `cpstop`.

   A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
   For faster resolution and verification, collect these files:
   1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
   2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

   **Hotfix installation instructions:**   
   Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

   **Note:** Install the hotfix on all Cluster members.
2. Enable the `fwha_silent_standby_mode` kernel parameter on the SIM and FW modules on both Cluster Members:

   1. Connect to each Cluster member with SSH and log in to Expert mode.

   2. Run the command:  
      # fw ctl set int fwha_silent_standby_mode 1

      Note: To make this permanent parameter change refer to the procedure in [sk26202](https://support.checkpoint.com/results/sk/sk26202).
3. After installing the hotfix, temporarily disable the Replay Attack protection on the relevant Cluster Object before running `cpstop` or `cphastop` on the Standby Gateway:

   **Note:** Disabling the Replay Attack Protection weakens VPN security. Only perform this action temporarily during maintenance and under guidance from Check Point Support.
   1. Connect with SmartConsole to the Security Management Server / Domain Management Server.

   2. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.) to avoid session conflicts.

      Verify by running the "cpstat mg" command on Security Management Server / in the context of each Domain Management Server.
   3. Connect with GuiDBedit Tool to Security Management Server / Domain Management Server. Refer to [sk13009](https://support.checkpoint.com/results/sk/sk13009) for details on GuiDBedit.

   4. In the upper left pane, navigate to **Table** \> **Network Objects** \> **network_objects**.

   5. In the upper right pane, select the applicable **gateway_cluster** object.

   6. Press CTRL+F (or go to Search menu - Find), paste **disable_replay_check** and click on **Find Next**.

   7. In the lower pane, right-click on the disable_replay_check, select **Edit...** , select **true** and click **OK**.

   8. Save the changes: Go to File menu and click **Save All**.

   9. Close the GuiDBedit Tool.

   10. Connect with SmartConsole to the Security Management Server / Domain Management Server.

   11. Install the policy on the applicable Security Gateway Cluster.

   After disabling the Replay Attack, you can run `cpstop` or `cphastop` on the Standby Gateway for any necessary maintenance
4. After you complete the changes on both Cluster Members, reenable the Replay Attack:

   1. Connect with SmartConsole to the Security Management Server / Domain Management Server.

   2. Close all SmartConsole windows (SmartDashboard, SmartView Tracker, SmartView Monitor, etc.)

      Verify by running the "cpstat mg" command on Security Management Server / in the context of each Domain Management Server.
   3. Connect with GuiDBedit Tool to Security Management Server / Domain Management Server.

   4. In the upper left pane, go to **Table** \>**Network Objects** \> **network_objects**.

   5. In the upper right pane, select the applicable **gateway_cluster** object.

   6. Press CTRL+F (or go to Search menu - Find), paste **disable_replay_check** and click on **Find Next**.

   7. In the lower pane, right-click on the **disable_replay_check** , select **Edit...** , select **false** and click **OK**.

   8. Save the changes: Go to File menu and click **Save All**.

   9. Close the GuiDBedit Tool.

   10. Connect with SmartConsole to the Security Management Server / Domain Management Server.

   11. Install the policy on the applicable Security Gateway Cluster.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content