bonding and ClusterXL

Ayoub_Bou — Mon, 24 Aug 2020 13:26:20 GMT

Hello,

i have a bond on 12600 appliance with 255 vlan on it , the port channel on my cisco Switch is up , on Firewall side it's up and all vlan interfaces are up, but i have some issues on HA with this bond , it stays down ,

[Expert@CKPT-FW:0]# cphaprob show_bond

[Expert@CKPT-FW:0]# cat /proc/net/bonding/bond7
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: IEEE 802.3ad Dynamic link aggregation
Transmit Hash Policy: layer2 (0)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 200
Down Delay (ms): 200

802.3ad info
LACP rate: slow
Min links: 0
Aggregator selection policy (ad_select): stable
System priority: 65535
System MAC address: 00:1c:7f:30:91:d4
Active Aggregator Info:
Aggregator ID: 2
Number of ports: 2
Actor Key: 9
Partner Key: 776
Partner Mac Address: 00:3a:9c:1f:f6:42

Slave Interface: eth1-01
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 3
Permanent HW addr: 00:1c:7f:30:91:d4
Slave queue ID: 0
Aggregator ID: 2
Actor Churn State: none
Partner Churn State: none
Actor Churned Count: 0
Partner Churned Count: 1
details actor lacp pdu:
system priority: 65535
system mac address: 00:1c:7f:30:91:d4
port key: 9
port priority: 255
port number: 1
port state: 61
details partner lacp pdu:
system priority: 32768
system mac address: 00:3a:9c:1f:f6:42
oper key: 776
port priority: 32768
port number: 8735
port state: 61

Slave Interface: eth1-04
MII Status: up
Speed: 1000 Mbps
Duplex: full
Link Failure Count: 5
Permanent HW addr: 00:1c:7f:30:91:d7
Slave queue ID: 0
Aggregator ID: 2
Actor Churn State: none
Partner Churn State: none
Actor Churned Count: 1
Partner Churned Count: 1
details actor lacp pdu:
system priority: 65535
system mac address: 00:1c:7f:30:91:d4
port key: 9
port priority: 255
port number: 2
port state: 61
details partner lacp pdu:
system priority: 32768
system mac address: 00:3a:9c:1f:f6:42
oper key: 776
port priority: 32768
port number: 87

[Expert@CKPT-FW:0]# cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 5
Required secured interfaces: 1

Interface Name: Status:

Sync (S) UP
Mgmt UP
eth3-01.118 UP
bond7.1601 (LS) DOWN (13329.3 secs)
eth3-02.1101 UP
eth3-02.1355 UP
bond7.1855 (LS) DOWN (13329.3 secs)

also after rebooting i have the message "ha module not started" ,i'm forced to start the process cphamcset manualy

Expert@CKPT-FW:0]# cphaprob -a if

HA module not started.

Warning: Sync will not function since there aren't any sync(secured) interfaces

does anyone know if there is any limiation on vlan interface with bonding that can cause ClusterXL to go crazy 🙂 .

Re: bonding and ClusterXL

Timothy_Hall — Mon, 24 Aug 2020 15:00:55 GMT

I assume the two firewalls can see each other's traffic on VLANs 1601 &1855, if so is there also at least one other responding IP address on those two VLANs other than the cluster members? If not the interface will be declared down by ClusterXL.

As far as the "there is no sync interface" message, this can be caused by a variety of ClusterXL issues, see this SK for increasingly intrusive ways to rectify it: sk39047: Output of 'cphaprob -a if' command shows 'Sync will not function since there aren't any sync(secured) interfaces' after replacing o

Re: bonding and ClusterXL

Wolfgang — Mon, 24 Aug 2020 19:39:34 GMT

@Ayoub_Bou

sometimes I saw this error „Warning: Sync will not function since there aren't any sync(secured) interfaces“.

All problematic cases are solved with Step 1 from Output of 'cphaprob -a if' command shows 'Sync will not function since there aren't any sync(secured) interfaces' ... mentioned by @Timothy_Hall

Wolfgang

topic bonding and ClusterXL in Firewall and Security Management

bonding and ClusterXL

Re: bonding and ClusterXL

Re: bonding and ClusterXL