topic Delay when standby member to came up in Firewall and Security Management

Delay when standby member to came up

TRajkumar — Thu, 17 Oct 2024 19:57:22 GMT

HI Checkmates

Today i have seen new issue on cluster XL.

Environment: Distribution architecture

Version : R81.20

Hotfix : 84

Cluster members : 2 checkpoint appliances

When i do a cluster failover, secondary member takes at least 10 minutes to process the traffic. That time our all the services are goes down, after 10 minutes everything works fine. i did not observe any drops on log (smart console).

but the cluster state show active/standby states correctly. no delay on this part.

Kindly help me to sort out the new problem.

Thanks

Rajkumar T

Re: Delay when standby member to came up

the_rock — Thu, 17 Oct 2024 20:06:03 GMT

Can you please send outputs of below when this happens?

Andy

**********************

cphaprob roles

cphaprob state

cphaprob -a if

cphaprob -i list

cphaprob -l list

cphaprob syncstat

********************************

Personally, never seen such an issue myself, even back in R55.

Re: Delay when standby member to came up

Chris_Atkinson — Thu, 17 Oct 2024 22:38:04 GMT

Is there any dynamic routing involved or are there issues with stale ARP entries?

Do the issue occur regardless of which member is active or standby?

Re: Delay when standby member to came up

emmap — Fri, 18 Oct 2024 01:58:10 GMT

Have you run any tcpdumps and/or traffic captures to see if the packets are reaching the gateway during the outage period?

Re: Delay when standby member to came up

Timothy_Hall — Fri, 18 Oct 2024 15:19:48 GMT

Sounds like a Gratuitous ARP issue (which is the default setting), do you have VMAC set on the cluster object? That should help but if you still experience a 10-12 second delay upon failover even after setting VMAC you'll need to set portfast (NOT disable STP) on the switch ports the firewalls are connected to.

If everything is working properly, upon failover you should see the following traffic behavior:

Catastrophic Failover (active completely dies/crashes): Outage of up to 2.5 seconds

Non-Catastrophic Failover (active interface failure, clusterXL_admin down, etc.): Outage of up to 300 milliseconds

Re: Delay when standby member to came up

the_rock — Fri, 18 Oct 2024 15:43:23 GMT

@TRajkumar

Actually, @Timothy_Hall makes super valid point. Can you see if below is enabled or not?

Andy

Re: Delay when standby member to came up

Lesley — Fri, 18 Oct 2024 17:41:54 GMT

share fw tab -t connections -s from both members at the same time.

This will show if the connections are synced.

Re: Delay when standby member to came up

TRajkumar — Sat, 19 Oct 2024 04:50:06 GMT

HI Chris

There is no dynamic routing.

Re: Delay when standby member to came up

TRajkumar — Sat, 19 Oct 2024 04:51:15 GMT

Dear Timothy

Thanks i will try this.

Thanks

Rajkumar T

Re: Delay when standby member to came up

the_rock — Sat, 19 Oct 2024 13:01:39 GMT

Try to toggle that option and install policy and then do a failover test and see what happens. If no change, naybe open TAC case to further investigate.

Andy