topic After R81.10 Upgrade - Gateway member is not reachable in Firewall and Security Management

After R81.10 Upgrade - Gateway member is not reachable

starmen2000 — Mon, 04 Mar 2024 15:17:55 GMT

Hi Mates,

We are experiencing a strange problem. This morning, we started upgrading the cluster from R80.30 to R81.10. Once one member's upgrade was completed, we could no longer access the node. Upon checking via console, we found that the bond interface was up (the bond interface is the external interface facing the internet router). I can ping from one member to another cluster member, but I cannot ping from upgraded node to the internet or the next hop (the internet router). Therefore, we could not reach the gateway over the bond (external interface).

What we noticed that mac address of bond interface changes after upgrade. I dont know it it affects.

Afterward, we reverted the version back to R80.30, and everything worked again. It was really strange. Do you have any ideas on how to solve this problem?

Thanks

Re: After R81.10 Upgrade - Gateway member is not reachable

the_rock — Mon, 04 Mar 2024 16:00:16 GMT

I always found that when doing the upgrade, after you upgrade backup member, it may load initial policy, but that does not block ssh accessor web UI (unless web UI is on port other than 443).

Can you check if there is anything in messages files?

Best,

Andy

Re: After R81.10 Upgrade - Gateway member is not reachable

starmen2000 — Tue, 05 Mar 2024 04:06:37 GMT

Customer insists to revert to snapshot so that we couldn't check messages files. Issue was totally strange , we could not ping next hop gateway IP also (ISP router). I am suspicious about bonding feature and facing switch hsrp ( ha) configuration. But how can r81 10 upgrade lead this kind of issue, why it is related to version, and on r80.30 there is no problem but on r81 10 it occurs?

Re: After R81.10 Upgrade - Gateway member is not reachable

Mattias_Jansson — Tue, 05 Mar 2024 08:22:23 GMT

Arp issues are common after upgrades in my experience. Did you check the arp-table in the router after the upgrade and cleared it while troubleshooting?

Re: After R81.10 Upgrade - Gateway member is not reachable

Lesley — Tue, 05 Mar 2024 08:41:24 GMT

What Jumbo you picked?

Re: After R81.10 Upgrade - Gateway member is not reachable

starmen2000 — Tue, 05 Mar 2024 08:42:32 GMT

Blink image R81.10 + Take 130 JHF

Re: After R81.10 Upgrade - Gateway member is not reachable

the_rock — Tue, 05 Mar 2024 12:05:30 GMT

I would agree with that statement.

Andy