topic Re: R81.20 address problems in Firewall and Security Management

R81.20 address problems

Rui_Meleiro — Tue, 03 Oct 2023 08:33:37 GMT

Since yesterday we are experiencing a rather unusual and strange issue with one of our 3100 R81.20 (Take 26). Traffic stopped flowing all of a sudden. From the logs it was registered going out but no inbound traffic was happening. After a lot of fumbling around, we've changed the gateway External IP address and traffic begun flowing again. This morning, same issue. Reverting the IP address back to the original solved, at least by now. Has anyone ever experienced such an problem?

Regards

Rui Meleiro

Re: R81.20 address problems

_Val_ — Tue, 03 Oct 2023 09:03:23 GMT

Sounds like an urgent TAC case

Re: R81.20 address problems

Ruan_Kotze — Tue, 03 Oct 2023 09:09:00 GMT

Hi Rui,

ARP issue perhaps? Next time it happens, try doing a cluster failover, or if it's a single appliance run the following command:

#arping -c 4 -A -I eth1 10.20.10.20

Just replace 'eth1' with the correct interface and the IP address with whatever is configured on that interface.

Re: R81.20 address problems

Rui_Meleiro — Tue, 03 Oct 2023 09:40:31 GMT

Thank you for your insight, Ruan. My first though was also ARP, and have flushed all dynamic ARP tables on switchs and routers, including the appliance. Not sure how an arping probe will further that, but I'll make sure to check it.

Re: R81.20 address problems

Timothy_Hall — Tue, 03 Oct 2023 11:51:54 GMT

What does fw ctl arp show when the issue occurs? Are you using a cluster?

Re: R81.20 address problems

Rui_Meleiro — Tue, 03 Oct 2023 12:21:41 GMT

Hadn't had the chance to get that while the issue was happening. At this moment - last IP address change is ongoing without any issues - I get all of the IP addresses listening on the same segment, using the same interface mac address the gateway has. Gateway IP is x.x.x.27 and IPs x.x.x.28 and x.x.x.29 are shown. This is a standalone gateway.

Re: R81.20 address problems

the_rock — Tue, 03 Oct 2023 13:17:17 GMT

We upgraded customer recently to R81.20 and only weird issue I recall they had was that lost of users had their MS teams and zoom get disconnected randomly, but it was fixed by allowing all users to access all ms teams/zoom apps by creating a rule within internal layey in network ordered layer.

I cant say why that happened, but Im fairly sure its due to R81.20, as it was never an issue before upgrade (R80.40 and R81.10)

Anyway, onto your problem. I agree with the guys, sounds like an ARP problem. Do fw ctl zrp as @Timothy_Hall advised, but I also second what @_Val_ said. It definitely warrants call to TAC, as it rather sounds like an urgent problem.

You can also simply run arp when it works and when its broken and compare.

Andy

Re: R81.20 address problems

Timothy_Hall — Tue, 03 Oct 2023 13:22:34 GMT

I have seen proxy ARP issues with R81.20 Take 24 so very interested to see the output of fw ctl arp when it happens. I assume you are not using VMAC mode?

Re: R81.20 address problems

Rui_Meleiro — Wed, 04 Oct 2023 16:17:10 GMT

Not using VMAC mode. Nevertheless, after a power cycle to the ISP router the problem was solved as of now. I guesstimate the problem was on that router and not the appliance.

Re: R81.20 address problems

Rui_Meleiro — Wed, 04 Oct 2023 16:17:39 GMT

Thank you all for the valuable input.

Re: R81.20 address problems

the_rock — Wed, 04 Oct 2023 17:16:13 GMT

Happy to hear its fixed.

Andy