topic Re: Warning: R81.20 JHF 89 for VSX in Firewall and Security Management

Warning: R81.20 JHF 89 for VSX

Duane_Toler — Fri, 01 Nov 2024 20:29:48 GMT

I had a multi-hour call with Diamond TAC today dealing with a VSX cluster R81.20 after an update to JHF 89. We had one VS with an interface with multiple VLANs that was missing the highest VLAN on the monitored list. No matter what trick we did, we couldn't get the 2 JHF 89 gateways to sync up with the 1 older JHF gateway. It was affecting only ONE VS, too, not the others. All others worked just fine!

I rolled back JHF 89 and instead installed JHF 84 and all is well now. This may not affect everyone, but TAC told me about another case they had with the exact same issue.

Hopefully your updates aren't as troublesome, and may they bring you success, but be aware of your multi-VLAN interfaces for VSX. JHF 89 doesn't seem to play nice with those.

Re: Warning: R81.20 JHF 89 for VSX

Alex- — Fri, 01 Nov 2024 21:38:18 GMT

Apparently a known issue.

https://community.checkpoint.com/t5/Management/VSX-VS-Cluster-State-in-Smartconsole/m-p/231363#M40305

We also have an SR open for this on VSX running R81.10 and Take 150 onwards.

Re: Warning: R81.20 JHF 89 for VSX

the_rock — Fri, 01 Nov 2024 22:10:57 GMT

Good to know! I had old client tell me about it the other day, but I was not aware it was a known issue until I saw your post.

Andy

Re: Warning: R81.20 JHF 89 for VSX

JozkoMrkvicka — Fri, 01 Nov 2024 23:07:13 GMT

If we face issues with monitored VLANs, in most cases cpstop;cpstart from problematic VS help.

If not fixed after cprestart, there is not documented command:

fw vsx restart_vs <VSID>

Example for restarting VS 3: fw vsx restart_vs 3

Try that if it helps.

Re: Warning: R81.20 JHF 89 for VSX

Duane_Toler — Fri, 01 Nov 2024 23:20:29 GMT

Yep, did that, too. Good idea. Didn’t help, tho. VS remained down on the JHF 89 gateway.
Full rollback was the only remaining option.

Re: Warning: R81.20 JHF 89 for VSX

Jan_Kleinhans — Mon, 04 Nov 2024 12:01:25 GMT

Hello,

as Alex already mentioned we are one of the customers with this issue. And also TAC told us about other cases. Our case is open since 22 October. We are waiting for a debug script.

As it seems that there are more and more users experiencing this problem I wonder why checkpoint doesn't place a warning or at least a "known issue" so that customers planning to go to the "recommended" release will have something to go on.

Re: Warning: R81.20 JHF 89 for VSX

MatanYanay — Mon, 04 Nov 2024 13:13:16 GMT

Hi @Jan_Kleinhans

we will add it to the important note of the jumbo by tomorrow

Re: Warning: R81.20 JHF 89 for VSX

Jan_Kleinhans — Tue, 05 Nov 2024 13:00:11 GMT

Hello Matan,

you posted an entry this morning in this case. Where is this entry? Was the information wrong?

Regards,

Jan

Re: Warning: R81.20 JHF 89 for VSX

MatanYanay — Tue, 05 Nov 2024 13:45:44 GMT

Hi @Jan_Kleinhans we are still working on the most accurate communication.

meanwhile, be aware we have a fix and it will be released in the jumbo we plan to release next week

Thanks

Matan.

Re: Warning: R81.20 JHF 89 for VSX

MatanYanay — Wed, 06 Nov 2024 09:47:56 GMT

Hi All

We have identified an issue with the new Jumbo take that affects the VSX cluster env with VLANs.

During the installation on the Standby member, a temporary monitoring mismatch occurs:

the Standby begins monitoring only the lowest VLAN, while the Active member monitors both the lowest and highest VLANs.

This mismatch causes an "ACTIVE!" (on the member running the pre JHF 89 version) or Down state (instead of Standby state on the member running JHF 89) to be triggered.

Although this is a cosmetic issue and does not impact traffic flow or failover functionality, we still recommend that VSX customers wait for the next Jumbo release ( Plan to be released next week). Important note in the jumbo doc will be added today as well

For customers who wish to proceed with the installation, an SK with detailed installation instructions will be published today (and shared on this thread).

Re: Warning: R81.20 JHF 89 for VSX

Chris_Atkinson — Wed, 06 Nov 2024 15:01:29 GMT

sk182819 was published for this issue.

Re: Warning: R81.20 JHF 89 for VSX

the_rock — Wed, 06 Nov 2024 15:02:27 GMT

Awesome!

Re: Warning: R81.20 JHF 89 for VSX

JozkoMrkvicka — Wed, 06 Nov 2024 22:50:22 GMT

doing cpstop on active member cannot be considered as "manual failover". Better wording should be "hard switchover with small outage". Maitanance window is needed anyway.

It is also not clear from the article if cpstop/failover should be done from VS0 or from specific VS. Depending if VSX is in HA or VSLS mode.

In which world can happen that affected VS will be in STANDBY state while highest VLAN is not monitored correctly ? It has to be in DOWN state and "normal failover" cannot happen due to LPRB or IAC Pnote problem.

Re: Warning: R81.20 JHF 89 for VSX

JozkoMrkvicka — Thu, 07 Nov 2024 16:57:16 GMT

Starting from R81.20 Take 89, ONLY lowest VLAN is monitored.

Re: Warning: R81.20 JHF 89 for VSX

the_rock — Thu, 07 Nov 2024 17:07:36 GMT

Looks like just came out today.

Re: Warning: R81.20 JHF 89 for VSX

genisis__ — Thu, 07 Nov 2024 17:39:31 GMT

Will this also include a Jumbo update for JHFA106 on R81 (The issue is on this as well - TAC case raised and identified)

Re: Warning: R81.20 JHF 89 for VSX

Alex- — Thu, 07 Nov 2024 18:47:36 GMT

The SK mentions this issue is fixed in R82.

We don't see upgrading VSX clusters to R82 before a year of hotfixes if not more.

We see a similar issue in R81.10 and hope some fixes will roll out for other versions as well.

Re: Warning: R81.20 JHF 89 for VSX

JozkoMrkvicka — Thu, 07 Nov 2024 22:30:50 GMT

Only R81.10, R81.20 and R82 are still supported. All other versions are EoL already (R81 reached EoL in October 2024).

I agree with you about R82. Once R82 is not declared as Recommended version, there is no way I am going to put this version on production firewall. There are tons of bugs within R81.10 and R81.20. I will be surprised if R82 is exception.

Back to the topic - What does it mean that highest VLAN issue is fixed in R82 ? If it is by design that monitoring of highest VLAN is no longer available starting from R81.20 Take 89, what/how it is fixed in R82 ? R82 is just R81.20 Take 89 with updated kernel and fancy new features...

Re: Warning: R81.20 JHF 89 for VSX

genisis__ — Fri, 08 Nov 2024 11:52:41 GMT

We have a commercial agreement to extended support, hence my question and the fact a new Jumbo has been released for R81, so it makes sense CP should fix this issue prior going to final recommended release.

Re: Warning: R81.20 JHF 89 for VSX

JozkoMrkvicka — Fri, 08 Nov 2024 14:25:39 GMT

"Problem" solved then, close all the cases 🙂