Problem: CP gateways "lose" interfaces - fw getifs is empty - but ip address shows the interfaces

DH — Fri, 26 Jan 2024 10:08:29 GMT

I had a strange behavior on a gateway (appliance 3x00) that run on Gaia R81.10 JHF take 109.

after several month running without problems, during normal operation some night before the gateway was not reachable by network anymore.
HW seems to be okay.
Connection by serial port was possible.
every outgoing ping from the gateway returns "operation not permitted."
fw unloadlocal did not solve the problem.
fwaccel off did not solve the problem.

reboot didn't solve the problems. During boot the I can see that the gateway is unable to fetch the policy from gateway anymore, but without cp service the routing is working and the ports are reachable.

After cpstop all outgoing and incoming connections - beside NAT/VPN - worked based on routing.

After cpstart sames problem as before.

fw getifs did not show any interfaces anymore!

But ip address/ip route showed the correct configuration, show config in clish, too.

After that we did a factory restore the R77.30 and upgrade to R81.10, reset SIC, reconnect to Mgmt and do a policy install with the old policy - no problems, every thing worked again.

Then we did a upgrade to JHF 109 an we had the same problems as before.
A uninstall of the JHF did not solve the problems!

fw getifs still did not show any interface anymore!

I had a similar problem a year before at a different customer on all nodes of 2 gateway clusters (5x00 and 3x00) with R81.10 JHF take79 after reboot of these clusters.

We did a fresh install of these gateways, which solved the problems.

I already opened a case at CP.

They told me, based on the analyze of the snapshot files, there was a mismatch between OS interface mapping and CP interface mapping...that should not happened...

but the root cause is still unknown!

Inside the Smart Center objects the interfaces are correct...

So my question is, did anyone had similar problems before?

Re: Problem: CP gateways "lose" interfaces - fw getifs is empty - but ip address shows th

PhoneBoy — Sat, 27 Jan 2024 21:43:49 GMT

Doesn’t matter what the OS configuration says if the firewall kernel module can’t see the interfaces.
Interface mapping issues is usually an issue that you see on Open Servers only.

I do know that we did a kernel update in R81.20 which also included updates to the various NIC drivers.
If I had to guess, it has something to do with that.
We should have handled this through the upgrade process, though…

topic Re: Problem: CP gateways "lose" interfaces - fw getifs is empty - but ip address shows th in Firewall and Security Management

Problem: CP gateways "lose" interfaces - fw getifs is empty - but ip address shows the interfaces

Re: Problem: CP gateways "lose" interfaces - fw getifs is empty - but ip address shows th