> Source: [sk185093](https://support.checkpoint.com/results/sk/sk185093) # sk185093 - ElasticXL non-SMO member cannot ping Smart-1 Cloud Management Server over MaaS tunnel | Property | Value | |----------|-------| | Solution ID | sk185093 | | Date Created | 2026-06-24 | | Last Modified | 2026-07-07 | | Technical Level | Advanced | | Products | Scalable Platforms | | Versions | R82.10, R82 | | OS | Gaia | ## Symptoms - * The non-SMO member cannot ping the Management Server through the MaaS tunnel unless an explicit Security Policy rule allows this traffic, for example: > \[Expert@Elastic1-s01-02:0\]# fw up_execute src=\ dst=100.64.0.52 ipp=1 type=8 code=0 in_if=localhost > > Rulebase execution ended successfully. > > Overall status: > --------------- > **Match status: MATCH** > **Match action: Drop** > Object types required for matching: None > Object types required for logging: None > > Per Layer: > ---------- > Layer name: Network > Layer uid: d5d47bda-d0cc-41a3-bcfc-2d62b65098e4 > Layer id: 0 > **Match status: MATCH** > **Match action: Drop** > **Matched rule: 5** > > Reported clobs: > --------------- > Type 4 (SERVICE): > echo-request > icmp-proto > > \[Expert@Elastic1-s01-02:0\]# ping 100.64.0.52 > > PING 100.64.0.52 (100.64.0.52) 56(84) bytes of data. > > --- 100.64.0.52 ping statistics --- > 5 packets transmitted, 0 received, 100% packet loss * In Smart-1 Cloud Insights, the second ElasticXL member is reported to have problems affecting the Management Server and Log Server, for example: \[Expert@Elastic1-s01-01:0\]# insights Under the **NetScout** section ``` ??? NetScout(!) ??? ? ? ? NOTICE ? ? ? ??????????????????? ``` > Non-explicit rule > > | Name | Host | 1_01 | 1_02 | > |-------------------|-------------|------------|------| > | Management Server | 100.64.0.52 | UP (107ms) | DOWN | > | Log Server 1 | 100.64.0.52 | UP (106ms) | DOWN | > > With an explicit rule > > | Name | Host | 1_01 | 1_02 | > |-------------------|-------------|------------|-------------| > | Management Server | 100.64.0.52 | UP (150ms) | UP (99.0ms) | > | Log Server 1 | 100.64.0.52 | UP (146ms) | UP (102ms) | * The MaaS tunnel appears operational on both ElasticXL members. > ``` > [Expert@Elastic1-s01-01:0]# maas status > 1_01: > MaaS Status: Enabled > MaaS Tunnel State: Up > MaaS domain-name: guxx-xxxxbz4.maas.checkpoint.com > Connected to Infinity Portal: https://cloudinfra-gw.portal.checkpoint.com > Gateway IP for MaaS Communication: > > 1_02: > MaaS Status: Enabled > MaaS Tunnel State: Up > MaaS domain-name: guxx-xxxxbz4.maas.checkpoint.com > Connected to Infinity Portal: https://cloudinfra-gw.portal.checkpoint.com > Gateway IP for MaaS Communication: > ``` * Only the SMO member can successfully ping the Management Server. > ``` > > === Elastic1-s01-01 === > [Expert@Elastic1-s01-01:0]# fw up_execute src= dst=100.64.0.52 ipp=1 type=8 code=0 in_if=localhost > > Rulebase execution ended successfully. > > Overall status: > --------------- > Match status: MATCH > Match action: AcceptObject types required for matching: None > Object types required for logging: None > > Per Layer: > ---------- > Layer name: Network > Layer uid: d5d47bda-d0cc-xxxx-yyyy-2d62b650015a > Layer id: 0 > Match status: Override by implied rule before last: accept_outgoing (id 64) > Match action: Accept > Reported clobs: > --------------- > Type 4 (SERVICE): > echo-request > icmp-proto > > [Expert@Elastic1-s01-01:0]# ping 100.64.0.52 > > PING 100.64.0.52 (100.64.0.52) 56(84) bytes of data. > 64 bytes from 100.64.0.52: icmp_seq=1 ttl=64 time=381 ms > 64 bytes from 100.64.0.52: icmp_seq=2 ttl=64 time=375 ms > 64 bytes from 100.64.0.52: icmp_seq=3 ttl=64 time=380 ms > 64 bytes from 100.64.0.52: icmp_seq=4 ttl=64 time=758 ms > 64 bytes from 100.64.0.52: icmp_seq=5 ttl=64 time=373 ms > 64 bytes from 100.64.0.52: icmp_seq=6 ttl=64 time=537 ms > 64 bytes from 100.64.0.52: icmp_seq=7 ttl=64 time=772 ms > 64 bytes from 100.64.0.52: icmp_seq=8 ttl=64 time=375 ms > 64 bytes from 100.64.0.52: icmp_seq=9 ttl=64 time=370 ms > 64 bytes from 100.64.0.52: icmp_seq=10 ttl=64 time=370 ms > 64 bytes from 100.64.0.52: icmp_seq=11 ttl=64 time=379 ms > > --- 100.64.0.52 ping statistics --- > 11 packets transmitted, 11 received, 0% packet loss > rtt min/avg/max/mdev = 370.619/461.423/772.245/150.666 ms > ``` * The traffic is dropped by the cleanup rule, for example: >
> > \[Expert@Elastic1-s01-01:0\]# fw ctl zdebug + drop \| grep 100.64.0.52 > > @;\[vs_0\];\[tid_4\];\[fw4_4\];fw_log_drop_ex: Packet proto=1 \ -\> 100.64.0.52:0 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Network" rule 152; > > @;\[vs_0\];\[tid_1\];\[fw4_1\];fw_log_drop_ex: Packet proto=1 \ -\> 100.64.0.52:0 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Network" rule 152; > > @;\[vs_0\];\[tid_1\];\[fw4_1\];fw_log_drop_ex: Packet proto=1 \ -\> 100.64.0.52:0 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Network" rule 152; > > @;\[vs_0\];\[tid_2\];\[fw4_2\];fw_log_drop_ex: Packet proto=1 \ -\> 100.64.0.52:0 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "Network" rule 152; ## Cause In an ElasticXL environment that connects to Smart-1 Cloud, ICMP traffic from a non-SMO member to the Smart-1 Cloud Management Server does not match the management access allowed in the current policy and is dropped by the cleanup rule. ## Solution This solution requires authentication. Please log in to view the full solution. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content