> Source: [sk66881](https://support.checkpoint.com/results/sk/sk66881)

# sk66881 - On OPSec/VRRP cluster, output of 'cphaprob state' does not show the local member, only peer members

| Property | Value |
|----------|-------|
| Solution ID | sk66881 |
| Date Created | 2012-02-08 |
| Last Modified | 2023-03-23 |
| Technical Level | General |
| Products | Security Gateway, Cloud Firewall |
| Versions | R82.10, R82, R81.20, R82.10, R81.20, R82 |
| OS | Linux |

## Symptoms

- When running '`cphaprob state`' command on OPSec cluster members, the output does not show the local member, only peer members.

## Cause

When '**`fwha_freeze_state_machine_timeout`** ' kernel parameter is set permanently per [sk26202](http://supportcontent.checkpoint.com/solutions?id=sk26202), one of the arrays in Check Point kernel (which defines whether the local machine exists) is not initialized.

## Solution

*Example of OPSec cluster with 3 members* :   

Note:  
OPSec cluster applies to

* cluster on Crossbeam chassis
* cluster of Security Gateway VE for VMWare ESX
* cluster on IPSO OS

<br />

<br />

**MEMBER_A**

```
# cphaprob state

Cluster Mode:  Sync only (OPSEC)
Number     Unique Address  Firewall State
2          192.168.4.22    Active
3          192.168.4.23    Active
```

<br />

**MEMBER_B**

```
# cphaprob state
Cluster Mode:  Sync only (OPSEC)
Number     Unique Address  Firewall State
1          192.168.4.21    Active
3          192.168.4.23    Active
```

<br />

**MEMBER_C**

```
# cphaprob state
Cluster Mode:  Sync only (OPSEC)
Number     Unique Address  Firewall State
1          192.168.4.21    Active
2          192.168.4.22    Active
```

*** ** * ** ***

[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

This hotfix adds a new kernel parameter '**`fwha_set_member_exist_when_freeze_enabled`**', which is by default to 1 (one). This parameter enables the necessary fix.

*** ** * ** ***

If the user chooses not to install a hotfix, then manual changes must be implemented according to the following procedure :

<br />

**Action plan:**

1. permanently unset '`fwha_freeze_state_machine_timeout`'
2. set '`fwha_freeze_state_machine_timeout`' via `$FWDIR/bin/fwstart` script

**Detailed steps:**

1. Backup the current start-up script on each cluster member   

   **`[Expert@HostName]# cp $FWDIR/bin/fwstart $FWDIR/bin/fwstart_ORIGINAL`**   

2. Edit `$FWDIR/bin/fwstart` start-up script on each cluster member   

   **`[Expert@HostName]# vi $FWDIR/bin/fwstart`**   

   Find this section :  
   **`# -------------------- Clustering ------------------------`**   

   At the end of this section add this line:  
   **`fw ctl set int fwha_freeze_state_machine_timeout `*DESIRED_TIMEOUT_IN_SECONDS_IN_HEXADECIMAL_FORMAT***   

   So, the end of this section looks like this:  

   ```
       $FWDIR/bin/cphaprob -f $FWDIR/conf/cphaprob.conf register
       $FWDIR/bin/cphastart
     endif
   endif
   fw ctl set int fwha_freeze_state_machine_timeout DESIRED_TIMEOUT_IN_SECONDS_IN_HEXADECIMAL_FORMAT
   # --------------------------------------------------------
   ```

<br />

1. Permanently unset '`fwha_freeze_state_machine_timeout`' per [sk26202](http://supportcontent.checkpoint.com/solutions?id=sk26202)   

   * for Linux OS : remove the line with '`fwha_freeze_state_machine_timeout`' parameter from `$FWDIR/boot/modules/fwkern.conf` file

   <br />

   * for IPSO 4.x and IPSO 5.x OS : set '`fwha_freeze_state_machine_timeout`' parameter to 0 (zero) with 'modzap'

   <br />

   * for IPSO 6.x OS : remove '`fwha_freeze_state_machine_timeout`' parameter from configuration

<br />

<br />

1. Reboot each cluster member

<br />

<br />

1. Check if the local member is displayed   

   **`[Expert@HostName]# cphaprob state`**

<br />

<br />

1. Check if the desired value for '`fwha_freeze_state_machine_timeout`' parameter was accepted   

   **`[Expert@HostName]# fw ctl get int fwha_freeze_state_machine_timeout`**

<br />

<br />

*** ** * ** ***

<br />

<br />

**Related Solutions:**

* [sk32488 - When to use 'fwha_freeze_state_machine_timeout' parameter](http://supportcontent.checkpoint.com/solutions?id=sk32488)

[](primus://skcenter.checkpoint.comsk32488)

* [](primus://skcenter.checkpoint.comsk32488)[sk25971 - Failover occurs in the cluster during Security Policy installation](http://supportcontent.checkpoint.com/solutions?id=sk25971)

[](primus://skcenter.checkpoint.comsk25971)

* [](primus://skcenter.checkpoint.comsk25971)[sk66064 - Change of Cluster Member priority when the kernel parameter 'fwha_freeze_state_machine_timeout' is enabled may cause network outage](http://supportcontent.checkpoint.com/solutions?id=sk66064)

[](primus://skcenter.checkpoint.comsk66064)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content