1.1 Management HA Architecture & Primary/Secondary SMS Setup

Management High Availability (MHA) Architecture Overview

In modern enterprise networks, the Security Management Server (SMS) serves as the central control plane for rulebase policy creation, network object definitions, administrator session tracking, threat prevention intelligence, and Security Gateway logging. If a single standalone SMS fails due to hardware breakdown, network isolation, or operating system corruption, security administrators lose the ability to deploy emergency access policies, audit network activity, and manage security incidents.

Check Point R82 addresses single-point-of-failure risks in the management plane through Management High Availability (MHA). Management HA enables two or more Security Management Servers to share identical management database definitions, object libraries, and policy rulebases. MHA operates under a strict Active/Standby redundancy model:

• Active Security Management Server: The active server hosts read-write access to the Check Point Management (CPM) database backend. It processes administrator login sessions from SmartConsole, accepts policy modifications, executes policy compilations (fwc), and pushes compiled policy packages to Security Gateways over Secure Internal Communication (SIC).
• Standby Security Management Server: The standby server maintains a continuously updated, read-only replica of the management database. While administrators can connect SmartConsole to a Standby SMS to view read-only security policies, object properties, and historical audit logs, policy editing, session publishing, and gateway policy installation are locked until the Standby SMS is explicitly promoted to Active status.

+---------------------------------------------------------------------------------+
|                        MANAGEMENT HIGH AVAILABILITY TOPOLOGY                    |
|                                                                                 |
|   +--------------------------+                 +--------------------------+   |
|   |   Primary SMS (Active)   |                 |  Secondary SMS (Standby) |   |
|   |  - Master ICA Server     |                 |  - Read-Only CPM Replica |   |
|   |  - Read-Write Database   |<===============>|  - Standby Sync Daemon   |   |
|   |  - Active CPM Daemon     |  Encrypted Sync |  - Backup ICA Cert       |   |
|   +--------------------------+   (TCP 18190)   +--------------------------+   |
|                |                                            |                   |
|   SIC Control  |                                            | Dual Log Target   |
|   (TCP 18191)  |                                            | (TCP 257)         |
|                v                                            v                   |
|   +-----------------------------------------------------------------------+     |
|   |                      Managed Security Gateways                        |     |
|   |       (Local compiled policy executing in $FWDIR/state/local/)        |     |
|   +-----------------------------------------------------------------------+     |
+---------------------------------------------------------------------------------+

---

Primary vs. Secondary SMS Installation Roles

Establishing Management High Availability requires an intentional installation sequence using Check Point Gaia operating system images. The deployment order dictates server authority and Internal Certificate Authority (ICA) ownership.

1. Primary Security Management Server

The Primary SMS is the initial management server installed in the enterprise domain. During the Gaia First Time Configuration Wizard, the administrator selects Security Management and designates the node as the Primary management server.

Key responsibilities of the Primary SMS include:

• Master ICA Initialization: The Primary SMS automatically initializes the root Internal Certificate Authority (ICA) for the entire Check Point management domain. The ICA generates the root CA certificate and private key stored in $FWDIR/conf/internal_ca.idx.
• Object Database Creation: Generates master baseline files including objects_5_0.C (network/host object definitions), rulebases_5_0.fws (security policies), and the initial PostgreSQL schema managed by the Check Point Management (CPM) process.
• Initial SIC Trust Anchor: Serves as the authoritative issuer of SIC certificates for all managed Security Gateways, cluster members, secondary management servers, and log servers.

2. Secondary Security Management Server

The Secondary SMS is installed as a peer management node to provide high availability. During the Gaia First Time Configuration Wizard on the secondary hardware appliance or virtual machine, the administrator selects Security Management, but explicitly designates the installation type as Secondary Management Server.

Key characteristics of the Secondary SMS during initial setup:

• No Standalone ICA: The Secondary SMS does not generate a standalone ICA. Instead, it prepares an internal trust agent waiting to receive an ICA-issued server certificate signed by the Primary SMS.
• Blank Database State: Until SIC trust is established and an initial Full Synchronization is completed, the Secondary SMS contains no network objects, policy packages, or administrator accounts.

---

SmartConsole Initialization & Object Creation Workflow

Once the Primary SMS is operational and the Secondary SMS has completed its First Time Configuration Wizard, the administrator initializes Management HA by defining the Secondary SMS object within SmartConsole.

Step-by-Step Configuration Procedure

1. Connect SmartConsole to Primary SMS: Open Check Point SmartConsole R82, enter the IP address of the Primary SMS, and authenticate with full Read/Write administrator credentials.
2. Create Secondary Management Object: Navigate to the Objects Tree panel -> Click New -> Gateways & Servers -> Check Point Host -> Select Secondary Management.
3. Configure General Properties:
   • Name: Assign a unique hostname (e.g., SMS-Secondary-01).
   • IPv4 Address: Enter the dedicated management IP address of the Secondary SMS.
4. Define Dedicated Sync IP Interface:
   • In the Network Management tab, define the appliance network interfaces.
   • Best practice requires designating a dedicated synchronization IP interface connected over an isolated VLAN or direct cable. This isolates heavy database sync traffic (TCP port 18190) from general administrative SmartConsole sessions and gateway log transport.
5. Configure HA Object Properties:
   • Navigate to the Management tab within the Check Point Host object.
   • Enable the Management High Availability checkbox.
   • Enable the Log Server checkbox (enables secondary log collection capabilities).

+---------------------------------------------------------------------------------+
| SMARTCONSOLE: SECONDARY MANAGEMENT OBJECT PROPERTIES                            |
|                                                                                 |
| General Properties -> Name: SMS-Secondary-01 | IPv4: 192.168.10.20             |
|                                                                                 |
| Management Tab:                                                                 |
|  [*] Management High Availability                                               |
|  [*] Log Server                                                                 |
|                                                                                 |
| Secure Internal Communication (SIC):                                            |
|  Status: First time setup required                                              |
|  [ Initialize... ]  <-- Click to enter One-Time Activation Key                  |
+---------------------------------------------------------------------------------+

---

Establishing Secure Internal Communication (SIC) & Trust Verification

Secure Internal Communication (SIC) is the security protocol layer that authenticates and encrypts all communication between Check Point components using RSA keys and X.509 certificates issued by the Primary SMS ICA.

SIC Initialization Handshake Sequence

1. Define Activation Key on Secondary SMS: On the Secondary SMS, open Gaia Clish or the Gaia Web Portal and set a secure Activation Key (one-time password):

[Expert@SMS-Secondary:0]# clish SMS-Secondary> set sic_init password MySecretActivationKey123! SMS-Secondary> save config

2. **Initiate Trust from SmartConsole**: In the Secondary Management object properties dialog on SmartConsole, click the **Initialize...** button under the Secure Internal Communication section.
3. **Enter Activation Key**: Input the matching Activation Key (`MySecretActivationKey123!`) and click **Initialize**.
4. **Certificate Issuance & Handshake**:
   * SmartConsole connects to the Primary SMS ICA daemon (`cpca`).
   * Primary ICA initiates an authenticated TLS session over **TCP port 18191** (`cpd` process) to the Secondary SMS.
   * The Primary ICA issues an X.509 certificate to the Secondary SMS. The certificate is stored locally on the Secondary SMS at `$FWDIR/conf/sic_cert.p12`.
5. **Trust Verification**: Once successful, SmartConsole displays the trust status as **Trust Established**. Clicking **Test SIC** verifies mutual certificate validation and cryptographic handshakes across both management nodes.

```bash
# Verifying SIC status via Gaia Expert mode CLI on Primary SMS
[Expert@SMS-Primary:0]# cpstat mgmt -f sic

SIC Status: Trust Established
ICA Certificate Subject: CN=SMS-Secondary-01,O=SMS-Primary..8x9q2z

---

High Availability Object Properties & Dual Log Target Topology

When Management HA is established, managed Security Gateways must be aware of both management nodes for policy verification and log forwarding.

Managed Gateway Object Configuration

Managed Security Gateways store management server trust details in their local configuration files ($FWDIR/conf/masters.C). To configure redundant log targets:

1. Open the properties of managed Security Gateway objects in SmartConsole.
2. Navigate to Logs -> Local Storage / Log Servers.
3. Under Backup Log Servers, add the Secondary SMS object.
4. Save and Publish changes, then perform a Policy Installation.

During normal operation, Security Gateways send encrypted log records over TCP port 257 to the Primary Log Server. If the Primary SMS/Log Server experiences an outage or network disconnect, the gateway daemon (cpd / fwd) automatically redirects log streams to the Secondary Log Server without dropping security logs.

---

Technical Comparison: Primary SMS vs. Secondary SMS