1.2 Management HA Synchronization (Full Sync vs. Delta Sync, Session Sync)

Management HA Synchronization Architecture

Database consistency is the foundation of Check Point Management High Availability (MHA). For a Standby Security Management Server (SMS) to serve as a reliable backup capable of taking over policy enforcement and gateway management at any moment, its local management database must precisely mirror the Active SMS.

In Check Point R82, database synchronization is orchestrated by the Check Point Management (CPM) daemon and the underlying PostgreSQL database engine. Synchronization communication travels exclusively across a encrypted channel on TCP port 18190 between the CPM daemons running on the Primary and Secondary management nodes. MHA employs two primary synchronization mechanisms: Full Synchronization and Delta Synchronization.

+---------------------------------------------------------------------------------+
|                   CPM SYNCHRONIZATION ENGINE & DB STRUCTURE                     |
|                                                                                 |
|   +---------------------------+                 +---------------------------+   |
|   |    Active Management SMS  |                 |   Standby Management SMS  |   |
|   |                           |                 |                           |   |
|   |  +---------------------+  |                 |  +---------------------+  |   |
|   |  | Private Admin Edit  |  |                 |  | Read-Only Replica   |  |   |
|   |  | Session (Local)     |  |                 |  | Database            |  |   |
|   |  +---------------------+  |                 |  +---------------------+  |   |
|   |             |             |                 |             ^             |   |
|   |             v (Publish)   |   Delta Sync    |             |             |   |
|   |  +---------------------+  |   (TCP 18190)   |  +---------------------+  |   |
|   |  | CPM PostgreSQL DB   |==|=================|=>| CPM PostgreSQL DB   |  |   |
|   |  | ($FWDIR/conf/)      |  | Encrypted Diff  |  | ($FWDIR/conf/)      |  |   |
|   |  +---------------------+  |                 |  +---------------------+  |   |
|   +---------------------------+                 +---------------------------+   |
+---------------------------------------------------------------------------------+

---

Full Synchronization vs. Delta Synchronization

Check Point R82 optimizes network bandwidth and management server performance by utilizing two distinct modes of database synchronization.

1. Full Synchronization (Full Sync)

Full Synchronization is a bulk database transfer operation where the Active SMS exports its entire management database payload, compresses it into a temporary archive package, and pushes it across TCP port 18190 to the Standby SMS. Upon receipt, the Standby SMS overwrites its local database files and CPM PostgreSQL tables with the imported snapshot.

• Trigger Conditions:
  1. Immediately following initial SIC trust establishment between Primary and Secondary SMS objects.
  2. Manual administrator invocation by clicking Sync Now within the SmartConsole High Availability panel.
  3. Mandatory resolution procedure following a Collision status state.
  4. Server recovery after extended network partitioning or system reinstallation.
• Synchronized Payload Components:
  • Entire contents of $FWDIR/conf/ (including objects_5_0.C, rulebases_5_0.fws, res_5_0.C).
  • Complete CPM PostgreSQL database export (cpm_revisions, object GUID tables, audit logs).
  • Internal Certificate Authority database records ($FWDIR/conf/internal_ca.idx).
  • Security policy package definitions and version control snapshots.
• Performance Impact: High CPU and disk I/O utilization on both management nodes. During a Full Sync, database write locks are temporarily applied, preventing concurrent session publishing until the transfer and database import steps complete.

2. Delta Synchronization (Delta Sync)

Delta Synchronization is an automated, high-speed incremental update mechanism designed for routine operation. Rather than transferring the entire multi-gigabyte management database, Delta Sync isolates and transmits only the exact database modifications (deltas) generated since the last successful sync point.

• Trigger Conditions: Executed automatically whenever an administrator clicks Publish in SmartConsole R82 or executes a database modification command via the Management API (mgmt_cli publish).
• Operation Sequence:
  1. Administrator makes changes in SmartConsole (e.g., adding a Network Object or modifying an Access Control rule).
  2. Administrator clicks Publish.
  3. CPM commits the session changes into the local PostgreSQL database, creating a new revision ID.
  4. CPM calculates the incremental delta payload representing the revision diff.
  5. CPM opens a TCP port 18190 connection to the Standby SMS CPM daemon and streams the delta payload.
  6. Standby CPM applies the delta payload atomically to its local database replica.
• Performance Impact: Minimal CPU and network footprint. Delta Sync completes in seconds, ensuring near-real-time database parity.

---

Synchronized Database Files & Database Schemas

To pass the CCSE exam, administrators must understand the key database files and directories synchronized between management nodes during HA operations:

$FWDIR/conf/
├── objects_5_0.C          # Network objects, host definitions, group definitions
├── rulebases_5_0.fws      # Security Access Control, Threat Prevention, NAT policies
├── masters.C              # Gateway management server and log server assignment maps
├── internal_ca.idx        # ICA certificate tracking ledger and serial index
└── sic_cert.p12           # Local node SIC PKCS#12 certificate store

In addition to legacy flat files in $FWDIR/conf/, R82 relies heavily on the CPM PostgreSQL database (located under $CPMDIR/db/). Synchronized CPM database entities include:

• cpm_revisions: Master ledger recording every published session, author ID, timestamp, and revision description.
• Session Objects: Workspace state tables tracking active published configurations.
• Administrator Roles & Permissions: Multi-administrator role-based access control (RBAC) schemas.

---

SmartConsole Synchronization Status Indicators

SmartConsole R82 provides visual HA status indicators within the Management High Availability status view (accessible via SmartConsole Menu -> Management High Availability). Administrators must instantly recognize and interpret these four standard status states:

+---------------------------------------------------------------------------------+
| SMARTCONSOLE: MANAGEMENT HIGH AVAILABILITY MONITOR                              |
|                                                                                 |
| Peer Name        IP Address      HA Mode    Sync Status      Last Sync Time     |
| ------------------------------------------------------------------------------- |
| SMS-Primary-01   192.168.10.10   Active     Synchronized     2026-07-22 14:30   |
| SMS-Secondary-01 192.168.10.20   Standby    Synchronized     2026-07-22 14:30   |
+---------------------------------------------------------------------------------+

1. Synchronized (Green Icon):
   • Meaning: The management databases on both Primary and Secondary servers are in full alignment. The latest published revision GUID on the Active SMS matches the Standby SMS.
2. Never Synchronized (Yellow/Gray Icon):
   • Meaning: SIC trust has been successfully established between the servers, but an initial Full Synchronization has not yet been executed.
   • Action Required: Perform a manual Sync Now operation in SmartConsole.
3. Sync in Progress (Blue Animated Icon):
   • Meaning: A Full Sync or Delta Sync data transfer is currently executing over TCP port 18190.
   • Action Required: Wait for the transfer and database import to complete.
4. Collision (Red Alert Icon):
   • Meaning: Desynchronization state where conflicting database edits were published independently on both Primary and Secondary servers while they were disconnected or isolated (split-brain scenario).
   • Action Required: Determine the authoritative server, select its object in SmartConsole, and choose Overwrite Peer to force a Full Sync.

---

Session Publishing & Concurrent Administration Dynamics

Check Point R82 features a powerful Concurrent Administration architecture. Multiple security administrators can log into SmartConsole simultaneously, with each administrator working inside an isolated private editing session.

Impact of Private Sessions on Management HA

Understanding how private editing sessions interact with Management HA is critical for CCSE certification:

• Unpublished Changes Are Private: Object creations, policy rule modifications, and NAT adjustments made inside an administrator's private session exist only in that administrator's transient workspace on the Active SMS.
• Sync Scope Excludes Unpublished Sessions: Delta Synchronization never transfers unpublished session data to the Standby SMS. If the Active SMS experiences a hardware crash while an administrator has unpublished work, those unpublished changes are lost.
• Publish Action Triggers Delta Sync: Only when an administrator clicks Publish does CPM commit the private session into the master PostgreSQL database, generate a revision ID, and initiate a Delta Sync payload to the Standby SMS.

+---------------------------------------------------------------------------------+
| CONCURRENT ADMINISTRATION & DELTA SYNC WORKFLOW                                 |
|                                                                                 |
|  Admin 1 (SmartConsole)  ---> [ Edit Rulebase ] -> Private Session (SMS-Active) |
|  Admin 2 (SmartConsole)  ---> [ Add Network Obj] -> Private Session (SMS-Active) |
|                                                           |                     |
|                                                    Admin 1 Clicks [ PUBLISH ]   |
|                                                           |                     |
|                                                           v                     |
|                                                  Commits to Active CPM DB       |
|                                                           |                     |
|                                                    Delta Sync (TCP 18190)       |
|                                                           |                     |
|                                                           v                     |
|                                                  Updates Standby CPM DB         |
+---------------------------------------------------------------------------------+

---

Technical Comparison: Full Sync vs. Delta Sync