> Source: [sk184877](https://support.checkpoint.com/results/sk/sk184877)

# sk184877 - ClusterXL split-brain, high RAM utilization, and policy installation failures on R82 Security Gateways

| Property | Value |
|----------|-------|
| Solution ID | sk184877 |
| Date Created | 2026-04-23 |
| Last Modified | 2026-06-11 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82 |
| OS | Gaia |

## Symptoms

- * One cluster member shows very high RAM utilization. The cluster becomes unstable, and traffic can stop passing. One or both members can report inconsistent High Availability roles. Policy installation fails on one member with errors such as `SYN Attack configuration error` and `New syntax configuration from policy is invalid`.

* When you test connectivity over the Sync path, traffic between cluster members can drop. On the affected Security Gateway / Cluster Member, kernel drop debug can show messages similar to:  

  `fw_cluster_ttl_anti_spoofing_reason: ttl check drop`

## Cause

A combination of conditions that cause a ClusterXL split-brain and unstable HA behavior:  

1. The cluster members do not run the same R82 Jumbo Hotfix Accumulator Take.  

* This mismatch cause differences in ClusterXL and kernel behavior across members.
* Under load and during policy installation, the members do not stay synchronized and fail to process cluster state changes consistently.

2. Resource exhaustion on one Security Gateway:  

* High RAM utilization can cause Check Point daemons and the HA module on a single cluster member to become not stable or stop.

3. Cluster traffic showed TTL-related anti-spoofing drops.  

4. Unstable policy state and SYN Attack configuration errors:  

* While one member is partially initialized and memory-starved, policy installation fail on that member with SYN Attack and syntax-related errors.
* The member remains in a state where it cannot accept a complete policy, which prevents it from rejoining the cluster normally and contributes to repeated failover attempts.

**Note:** Split-brain behavior can occur when CCP packets between members arrive with a TTL value smaller than 255.   
ClusterXL uses an anti-spoofing check to validate that CCP packets arrive with TTL 255. If the TTL value is smaller, ClusterXL drops the packets.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content