topic Re: VSX interface creation issue in Firewall and Security Management

VSX interface creation issue

mk1 — Thu, 26 Jan 2023 01:44:17 GMT

Hello all,

We have 3 VSX appliances which work in VSLS mode. I created new regular VLAN interface (bond0.111) on one of the virtual systems. Everything on the management seemed fine, but after that I noticed that VLAN interface was created only on one of the VSX members and it's missing on the others. Hence currently we have only one Active VS and the others are in DOWN state, which is a normal behaviour after one of the VSs has more interfaces than the others. I didn't try to add the interface manually on the other two members, because we prefer to configure everything on the VSX cluster from the SmartConsole. We've never seen that issue on the previous version R80.30. It started when we upgraded to R81.10. I have tried cpstop/cpstart on the affected VS, but it didn't help. I know we can try to create the missing interface manually, but this is not the point. I want when I create something from the SmartConsole to be working properly.

The software version of the VSX appliances is R81.10 with JHF Take 45.

Have you ever seen similar issue on your environments? Ticket was opened also to TAC.

Thank you!

Re: VSX interface creation issue

CheckPointerXL — Fri, 27 Jan 2023 11:37:41 GMT

Can you provide a screenshot that the VLAN is existing in one member and not in the other one?

Re: VSX interface creation issue

mk1 — Fri, 27 Jan 2023 11:57:41 GMT

Sure. In the attached screenshots you can see the VLAN interface is created on both members, but by some reason it's not part of cluster interfaces. You can see that from cphaprob -a if output.

Re: VSX interface creation issue

CheckPointerXL — Fri, 27 Jan 2023 12:05:42 GMT

try to force fetching conf file by vsx fetch on affected vs https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_VSX_AdminGuide/Topics-VSXG/CLI/vsx-fetch.htm

please compare fwkern.conf files from both member

Re: VSX interface creation issue

mk1 — Fri, 27 Jan 2023 12:14:01 GMT

fwkern.conf is identical on all 3 members. I will try "vsx fetch" together with removing and adding the interface again, if vsx fetch doesn't help. This is the second time we face similar issue since we upgraded to R81.10 and I'm afraid we will face it again in future and won't be good if we have to run "vsx fetch" or another manual command every time. I'm waiting TAC for some reasonable explanation.

Re: VSX interface creation issue

CheckPointerXL — Fri, 27 Jan 2023 12:15:52 GMT

ok, share the fix when TAC's job will be done 🙂

Re: VSX interface creation issue

mk1 — Fri, 24 Feb 2023 07:03:30 GMT

sk92784 solved the issue.