> Source: [sk185145](https://support.checkpoint.com/results/sk/sk185145)

# sk185145 - Maestro Security Group members do not synchronize BGP routes

| Property | Value |
|----------|-------|
| Solution ID | sk185145 |
| Date Created | 2026-07-23 |
| Last Modified | 2026-07-26 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20 |

## Symptoms

- * BGP routes are learned and installed correctly on the SMO member. However, the routes are not synchronized to another Security Group Member.

* The affected Security Group Member cannot establish or maintain the internal Check Point CPCL synchronization connection to the SMO over TCP port 2010.

* The output of the `show routed cluster-state` command on the affected Security Group Member shows:

  `Cluster Sync: In Progress`
* The *$FWDIR/log/routed.log* file on the affected Security Group Member contains messges similar to:

  ```
  
  cpcl_slave_connect_complete(4394): connection error 
  Transport endpoint is not connected
  ```

* Communication from the affected Security Group Member to the SMO on TCP port 2010 is rejected or reset although the routed daemon listens on the SMO. Example:

  ```
  
  [Expert:dplane]# netstat -anp | grep ":2010"
  tcp    0   0 192.0.2.1:2010       0.0.0.0:*         LISTEN   22638/routed
  ```

* The *$FWDIR/log/routed.log* file contains messages similar to:

  ```
  
  cpcl_pnote_report(4783): Setting Cluster Sync pnote to PROBLEM (Became standby)
  cpcl_pnote_report(4795): This pnote type and event is ignored on a bladed system
  cpcl_slave_init(4510): instance 0 connecting to master 192.0.2.1+55815
  cpcl_slave_init(4517): instance 0 connection waiting for select to return
  ```

* TCP port 2010 is missing from the MDPS configuration.

## Cause

The MDPS configuration is not identical on all Security Group Members. In the affected environment:

* The mdps_tun port is missing on one Security Group Member.

* TCP port 2010 is missing from the MDPS configuration.

TCP port 2010 is required for internal Maestro CPCL communication and route synchronization between the SMO and other Security Group Members. When the MDPS configuration does not include TCP port 2010, the affected Security Group Member cannot establish the CPCL synchronization channel to the SMO. As a result, BGP routes learned on the SMO are not synchronized to that member.

This behavior was observed when MDPS was configured before BGP, and MDPS was later disabled and enabled again after the BGP configuration was added. In this scenario, the MDPS communication entries were not consistent on all Security Group Members.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content