topic Re: R80.40 Cluster on Hyper-V in Cloud Firewall

R80.40 Cluster on Hyper-V

Corey_Clark — Fri, 19 Aug 2022 20:16:45 GMT

Has anyone see issues with the standby firewall communicating through active as it should when installedin Hyper-V. I have seen this in at least 3 different clusters so far. Traffic is seen leaving standby on sync interface, but never appears to never arrive at the active firewall.

Thanks,

Corey

Re: R80.40 Cluster on Hyper-V

Chris_Atkinson — Sat, 20 Aug 2022 07:31:40 GMT

Hi Corey,

Not aware of a Hyper-V specific behaviour myself but that doesn't mean there isn't something unique there.

Meanwhile take a look at sk169154 and see if it assists with your situation (may also require a CCP tweak in consultation with TAC).

Refer also: sk167453

Re: R80.40 Cluster on Hyper-V

Gary_Scott — Mon, 22 Aug 2022 13:32:22 GMT

I think this is due to hyper-V rejecting forged transmits. For a work around running fw ctl set int fwha_cluster_hide_active_only 0 per sk169154 does send the traffic out of the ext interface instead of the sync and with a no NAT rule for the cluster members traffic from the secondary now works. How can this be set to survive a reboot, fwkern.conf file with fw ctl set int fwha_cluster_hide_active_only 0 does not apply this parameter upon a reboot.

Re: R80.40 Cluster on Hyper-V

Chris_Atkinson — Mon, 22 Aug 2022 13:50:57 GMT

Did you configure it like below or something else?

fwha_cluster_hide_active_only=0

Re: R80.40 Cluster on Hyper-V

Corey_Clark — Mon, 22 Aug 2022 13:56:27 GMT

That would be my next step, just wanted to see if anyone else had experienced this behavior on hyper-v installations.

Re: R80.40 Cluster on Hyper-V

Gary_Scott — Mon, 22 Aug 2022 14:01:37 GMT

Something else, "fw ctl set -f int fwha_cluster_hide_active_only 0" used sk16202 as a reference. Just tried "fwha_cluster_hide_active_only=0" and that worked. Thank you!

Re: R80.40 Cluster on Hyper-V

Chris_Atkinson — Mon, 22 Aug 2022 14:10:35 GMT

Understood, seems Gary is testing for you. 😉