Ребут ноды

Заходим в GAIA:
Maintenance - Shut down - reboot

Проверка ISP Redundancy

В настройках мы сделали проверку каждого провайдера через пинг хостов Google DNS.
При сбое основного провайдера будет происходить переключение на резервный.
Проверка шюза:

cpstat fw

Проверка на SMS:

cpstat fw -h 192.168.252.251
cpstat fw -h 192.168.252.252

Возможные статусы
- OK
- The ISP link was manually disabled
- The interface is down
- The network cable is unplugged
- The interface has no next hop
- A host is not responding

Пример сбоя:

Также переключение можно увидеть через команду show route

show route

Любое изменения статуса ISP Redundancy будет обнулять age:

Разрешение на доступ к ноде по SCP

Заводим пользователя с параметрами:

Диагностика состояния системы

hcp -r all --include-wts yes

Далее можно скачать по scp диагностическую информацию.
Файл тяжелый: после создания удалить.

Проверяем какой шлюз стоит из GUI

Gateways&Services -> Device & License Information -> Network Activity -> Routing Table

Команды диагностики состояния кластера Смотрим версию и хотфиксы

[Expert@chkp01:0]# cpinfo -y all

This is Check Point CPinfo Build 914000231 for GAIA
[MGMT]
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  10
[IDA]
        No hotfixes..
[CPFC]
        No hotfixes..
[FW1]
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  10
        HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
        HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point's software version R81.20 - Build 703
kernel: R81.20 - Build 006
[SecurePlatform]
        HOTFIX_ENDER_V17_AUTOUPDATE
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  10
[CPinfo]
        No hotfixes..
[PPACK]
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  10
[AutoUpdater]
        No hotfixes..
[DIAG]
        No hotfixes..
[CVPN]
        HOTFIX_R81_20_JUMBO_HF_MAIN     Take:  10
        HOTFIX_ESOD_SWS_AUTOUPDATE
        HOTFIX_ESOD_CSHELL_AUTOUPDATE
        HOTFIX_ESOD_SCANNER_AUTOUPDATE
[core_uploader]
        HOTFIX_CHARON_HF
[CPUpdates]
        BUNDLE_R81_20_JUMBO_HF_MAIN     Take:  10
        BUNDLE_CPVIEWEXPORTER_AUTOUPDATE        Take:  27
        BUNDLE_CPOTELCOL_AUTOUPDATE     Take:  25
        BUNDLE_ENDER_V17_AUTOUPDATE     Take:  24
        BUNDLE_ESOD_SWS_AUTOUPDATE      Take:  14
        BUNDLE_ESOD_CSHELL_AUTOUPDATE   Take:  19
        BUNDLE_ESOD_SCANNER_AUTOUPDATE  Take:  10
        BUNDLE_INFRA_AUTOUPDATE Take:  58
        BUNDLE_DEP_INSTALLER_AUTOUPDATE Take:  25
        BUNDLE_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE        Take:  19
        BUNDLE_HCP_AUTOUPDATE   Take:  59
        BUNDLE_GOT_TPCONF_AUTOUPDATE    Take:  112
        BUNDLE_CPSDC_AUTOUPDATE Take:  23
        BUNDLE_CORE_FILE_UPLOADER_AUTOUPDATE    Take:  21
[cpsdc_wrapper]
        HOTFIX_CPSDC_AUTOUPDATE
[hcp_wrapper]
        HOTFIX_HCP_AUTOUPDATE
[CPotelcol]
        HOTFIX_OTLP_GA
[CPviewExporter]
        HOTFIX_OTLP_GA

Команды диагностики состояния кластера Состояние кластера

[Expert@chkp01:0]# cphaprob stat

Cluster Mode:   High Availability (Primary Up) with IGMP Membership

ID         Unique Address  Assigned Load   State          Name

1 (local)  192.168.252.77  100%            ACTIVE         CHKP01
2          192.168.252.78  0%              STANDBY        CHKP02


Active PNOTEs: None

Last member state change event:
   Event Code:                 CLUS-114104
   State change:               DOWN -> ACTIVE
   Reason for state change:    Member state has been changed due to higher priority of local cluster member in PRIMARY-UP cluster
   Event time:                 Tue Jun 20 14:10:52 2023

Last cluster failover event:
   Transition to new ACTIVE:   Member 2 -> Member 1
   Reason:                     Member state has been changed due to higher priority of remote cluster member 1 in PRIMARY-UP cluster
   Event time:                 Tue Jun 20 14:10:52 2023

Cluster failover count:
   Failover counter:           6
   Time of counter reset:      Tue May  2 13:13:36 2023 (reboot)

Команды диагностики состояния кластера Смотрим состояние интерфейсов

[Expert@chkp01:0]# ifconfig
Mgmt        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6C
            inet addr:192.168.77.101  Bcast:192.168.77.255  Mask:255.255.255.0
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:5642624 errors:0 dropped:0 overruns:0 frame:0
            TX packets:6148683 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:1100130583 (1.0 GiB)  TX bytes:3281603941 (3.0 GiB)

Sync        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6B
            inet addr:192.168.252.77  Bcast:192.168.252.79  Mask:255.255.255.252
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:68673187 errors:0 dropped:0 overruns:0 frame:0
            TX packets:70376912 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:10296867838 (9.5 GiB)  TX bytes:16736079766 (15.5 GiB)

bond1       Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:65
            UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
            RX packets:124888 errors:0 dropped:0 overruns:0 frame:0
            TX packets:115562 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:15486112 (14.7 MiB)  TX bytes:14329688 (13.6 MiB)

bond1.180   Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:65
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0 frame:0
            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

bond1.181   Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:65
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0 frame:0
            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

bond2       Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:67
            UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
            RX packets:124902 errors:0 dropped:0 overruns:0 frame:0
            TX packets:115561 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:15487848 (14.7 MiB)  TX bytes:14329564 (13.6 MiB)

bond2.180   Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:67
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0 frame:0
            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

bond2.181   Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:67
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:0 errors:0 dropped:0 overruns:0 frame:0
            TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

bond3       Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:66
            UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
            RX packets:150252190 errors:0 dropped:0 overruns:0 frame:0
            TX packets:151200412 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:64822257336 (60.3 GiB)  TX bytes:84561670811 (78.7 GiB)

bond3.75    Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:66
            inet addr:89.175.185.150  Bcast:89.175.185.159  Mask:255.255.255.224
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:73829531 errors:0 dropped:0 overruns:0 frame:0
            TX packets:57757637 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:51349254080 (47.8 GiB)  TX bytes:27240430099 (25.3 GiB)

bond3.81    Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:66
            inet addr:90.154.2.88  Bcast:90.154.2.95  Mask:255.255.255.240
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:76002686 errors:0 dropped:0 overruns:0 frame:0
            TX packets:93222889 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:11283587749 (10.5 GiB)  TX bytes:57300235100 (53.3 GiB)

bond4       Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6A
            UP BROADCAST RUNNING MASTER MULTICAST  MTU:1500  Metric:1
            RX packets:117397431 errors:0 dropped:518385 overruns:518385 frame:0
            TX packets:102330165 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:77928993489 (72.5 GiB)  TX bytes:56759455447 (52.8 GiB)

bond4.190   Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6A
            inet addr:192.168.252.251  Bcast:192.168.252.255  Mask:255.255.255.248
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:116971024 errors:0 dropped:0 overruns:0 frame:0
            TX packets:102110265 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:76198986754 (70.9 GiB)  TX bytes:56738448127 (52.8 GiB)

eth1        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:65
            UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:62440 errors:0 dropped:0 overruns:0 frame:0
            TX packets:57775 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:7742560 (7.3 MiB)  TX bytes:7164100 (6.8 MiB)

eth2        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:65
            UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:62440 errors:0 dropped:0 overruns:0 frame:0
            TX packets:57775 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:7742560 (7.3 MiB)  TX bytes:7164100 (6.8 MiB)

eth3        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:67
            UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:62450 errors:0 dropped:0 overruns:0 frame:0
            TX packets:57775 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:7743800 (7.3 MiB)  TX bytes:7164100 (6.8 MiB)

eth4        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:67
            UP BROADCAST RUNNING SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:62444 errors:0 dropped:0 overruns:0 frame:0
            TX packets:57775 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:7743056 (7.3 MiB)  TX bytes:7164100 (6.8 MiB)

eth5        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:66
            UP BROADCAST RUNNING ALLMULTI SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:2830449 errors:0 dropped:0 overruns:0 frame:0
            TX packets:66729045 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:240606243 (229.4 MiB)  TX bytes:40386806338 (37.6 GiB)

eth6        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:66
            UP BROADCAST RUNNING ALLMULTI SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:147421066 errors:0 dropped:0 overruns:0 frame:0
            TX packets:84470500 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:64581592950 (60.1 GiB)  TX bytes:44174828595 (41.1 GiB)

eth7        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6A
            UP BROADCAST RUNNING ALLMULTI SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:60868331 errors:0 dropped:404686 overruns:404686 frame:0
            TX packets:51740159 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:33575360618 (31.2 GiB)  TX bytes:29126238410 (27.1 GiB)

eth8        Link encap:Ethernet  HWaddr 00:1C:7F:BF:8A:6A
            UP BROADCAST RUNNING ALLMULTI SLAVE MULTICAST  MTU:1500  Metric:1
            RX packets:56528967 errors:0 dropped:113699 overruns:113699 frame:0
            TX packets:50589677 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:44353610711 (41.3 GiB)  TX bytes:27633198891 (25.7 GiB)

lo          Link encap:Local Loopback  Media:unknown(auto)
            inet addr:127.0.0.1  Mask:255.0.0.0
            UP LOOPBACK NOTRAILERS RUNNING PROMISC ALLMULTI DYNAMIC  MTU:65536  Metric:1
            RX packets:16582453 errors:0 dropped:0 overruns:0 frame:0
            TX packets:16582453 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000
            RX bytes:3550461869 (3.3 GiB)  TX bytes:3550461869 (3.3 GiB)

Команды диагностики состояния кластера Смотрим состояние конкретных интерфейсов

chkp01> show interface eth5
state on
mac-addr 00:1c:7f:bf:8a:66
type ethernet
link-state link up
mtu 1500
auto-negotiation on
speed 1000M
ipv6-autoconfig Not configured
monitor-mode Not configured
duplex full
link-speed 1000M/full
comments
ipv4-address Not Configured
ipv6-address Not Configured
ipv6-local-link-address Not Configured

Statistics:
TX bytes:40390362493 packets:66738348 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:240622947 packets:2830645 errors:0 dropped:0 overruns:0 frame:0
chkp01> show interface eth6
state on
mac-addr 00:1c:7f:bf:8a:66
type ethernet
link-state link up
mtu 1500
auto-negotiation on
speed 1000M
ipv6-autoconfig Not configured
monitor-mode Not configured
duplex full
link-speed 1000M/full
comments
ipv4-address Not Configured
ipv6-address Not Configured
ipv6-local-link-address Not Configured

Statistics:
TX bytes:44182353474 packets:84485807 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:64605147570 packets:147454055 errors:0 dropped:0 overruns:0 frame:0


chkp01> show configuration bonding
add bonding group 1
add bonding group 2
add bonding group 3
add bonding group 4
add bonding group 1 interface eth1
add bonding group 1 interface eth2
add bonding group 2 interface eth3
add bonding group 2 interface eth4
add bonding group 3 interface eth5
add bonding group 3 interface eth6
add bonding group 4 interface eth7
add bonding group 4 interface eth8
set bonding group 1 mode 8023AD
set bonding group 1 lacp-rate slow
set bonding group 1 min-links 0
set bonding group 1 mii-interval 100
set bonding group 1 down-delay 200
set bonding group 1 up-delay 200
set bonding group 1 xmit-hash-policy layer3+4
set bonding group 2 mode 8023AD
set bonding group 2 lacp-rate slow
set bonding group 2 min-links 0
set bonding group 2 mii-interval 100
set bonding group 2 down-delay 200
set bonding group 2 up-delay 200
set bonding group 2 xmit-hash-policy layer3+4
set bonding group 3 mode 8023AD
set bonding group 3 lacp-rate slow
set bonding group 3 min-links 0
set bonding group 3 mii-interval 100
set bonding group 3 down-delay 200
set bonding group 3 up-delay 200
set bonding group 3 xmit-hash-policy layer3+4
set bonding group 4 mode 8023AD
set bonding group 4 lacp-rate slow
set bonding group 4 min-links 0
set bonding group 4 mii-interval 100
set bonding group 4 down-delay 200
set bonding group 4 up-delay 200
set bonding group 4 xmit-hash-policy layer3+4

Команды диагностики состояния кластера Загрузка CPU

[Expert@chkp01:0]# top
[Expert@chkp01:0]# cpview

Команды диагностики состояния кластера Смотрим логи

cat /var/log/messages

Команды диагностики состояния кластера. Heavy connections

[Expert@chkp01:0]# fw ctl multik print_heavy_conn
[fw_0]; Conn: 188.32.120.25:9820 -> 90.154.2.82:443 IPP 6; Instance load: 60%; Connection instance load: 96%; StartTime: 28/06/23 23:57:14; Duration: 45; IdentificationTime: 28/06/23 23:58:31; Service: 6:443; Total Packets: 580916; Total Bytes: 443619248;

Как проверять, если доступа нет к публикациям

Смотрим логи доступа к белому адресу

Если ничего не видно, трафик можно посмотреть через консоль, доходит ли трафик вообще:

fw monitor -e "accept host(195.112.100.134);"

где 195.112.100.134 - адрес клиента, пытающегося зайти

Дополнительно можно отключить акселерацию пакетов, тогда он будет ловить больше. Это замедляет обработку трафика:

fwaccel off
fw monitor -e "accept host(195.112.100.134);"

Посмотреть дропнутые пакеты фаерволом и номер и номер правила:

fw ctl zdebug drop |grep 195.112.100.134

Посмотреть через tcpdump:

tcpdump -nni any host 195.112.100.134