topic Re: R81 cluster failover issues in Firewall and Security Management

R81 cluster failover issues

Paul_Hagyard — Fri, 02 Sep 2022 02:33:57 GMT

Has anyone noticed issues with non-stateful failover in R81 clusters?

We have two different customer environments running JHF take 68 (take 69 doesn't fix the problem) and on failover we see varying levels of dropped connections. We are seeing it on both VSX and standard clusters. Prior to failover everything looks normal, with the connections tables on each member having a similar number of entries. Immediately after failover there are multiple connections dropped with "first packet isn't SYN" and applications with longer connections that don't recovery instantly break.

We have an open SR for one customer, but after finding it in a second customer we're wondering if it's more widespread.

Re: R81 cluster failover issues

the_rock — Fri, 02 Sep 2022 02:47:12 GMT

Cant personally say I ever experienced that, mind you, I never recommended anyone stay on base R81, always asked clients to upgrade to R81.10 and no problems at all. Its possible its an issue in R81 version, but had not see any posts on that in community either. What did TAC advise?

Re: R81 cluster failover issues

Paul_Hagyard — Fri, 02 Sep 2022 02:52:07 GMT

TAC have suggested that our issue sounds similar to an open R&D investigation for R81.10, but this is not yet confirmed.

Re: R81 cluster failover issues

the_rock — Fri, 02 Sep 2022 02:56:24 GMT

I have hard time believing that, sorry. Im sure they did tell you so, but I worked with at least 10 customers on R81.10 with active/standby clusterXL and we never saw an issue like that. Not saying it cant happen, but I had never experienced it in R81.10 version.

Re: R81 cluster failover issues

Paul_Hagyard — Wed, 07 Sep 2022 02:37:02 GMT

PRJ-37211

Confirmed by TAC in both R81 and R81.10. Request a hotfix or wait until fixed in a future JHF.