What is NOT monitored as a PNOTE by ClusterXL?

ClusterXL's Problem Notification (PNOTE) mechanism monitors the state of critical daemons (processes) to ensure high availability. If a monitored daemon reports a problem, it can trigger a failover to a standby member. The daemons for core functions like VPN (vpnd), routing (routed), and policy enforcement (fwd) are considered critical and are monitored by default. The Threat Emulation daemon (ted) is part of a specific software blade and is not considered a core infrastructure process necessary for the cluster's basic operation; therefore, it is not monitored by a built-in PNOTE by default.

B. Policy: The firewall worker daemon (fwd), which is responsible for policy installation and enforcement, is a critical process monitored by a PNOTE.

C. RouteD: The routing daemon (routed) is essential for the gateway's ability to route traffic correctly and is monitored by a PNOTE.

D. VPND: The VPN daemon (vpnd) is critical for establishing and maintaining VPN tunnels and is monitored by a PNOTE.

---

1. Check Point R81.20 ClusterXL Administration Guide, Page 101, "Built-in PNOTEs".

This section lists the critical devices that are monitored by default. The list includes fwd, vpnd, and routed. The ted daemon is not on this list of built-in monitored processes.

2. Check Point SecureKnowledge (SK) Article sk25977: "List of all ClusterXL PNOTEs".

This official article provides a comprehensive list of daemons that register with the ClusterXL mechanism. It explicitly lists vpnd, routed, and fwd as processes that have built-in PNOTEs. The ted process is not included in this list of default PNOTEs.

3. Check Point SecureKnowledge (SK) Article sk92823: "ClusterXL commands".

This article details the use of the cphaprob list command, which shows the registered PNOTEs on a cluster member. The typical output shown in documentation and real-world examples confirms the presence of PNOTEs for fwd, routed, and vpnd, but not for ted.