topic Cluster active member lost R81.20 Take 98 in Firewall and Security Management

Cluster active member lost R81.20 Take 98

Fatalis — Thu, 31 Jul 2025 04:20:42 GMT

Following a recent replacement of the firewall cluster hardware and re‑IP of the cluster members, the standby member is reporting as Normal in SmartConsole, while the active member is displaying a “Lost” status.

Both members are reachable via SSH, and cphaprob stat indicates that the cluster members are powered on and appear healthy from the command line. ClusterXL traffic between members is also confirmed to be flowing normally, suggesting that synchronization is occurring.

However, logs from other connected systems began reporting anti‑spoofing drops shortly after the change.

Will test SIC re-establishment and fw unloadlocal next. Also users report successful traffic.

Re: Cluster active member lost R81.20 Take 98

Lesley — Thu, 31 Jul 2025 08:49:23 GMT

SIC is not working with the active member. This is not related to clustering. You have to check why SIC is not working. This is the communication between mgmt and fw. If you see spoofing drops maybe this SIC traffic is also dropped. Start with a quick drop check: fw ctl zdebug + drop | grep IP mgmt on the fw-a when you press SIC test in Smart Console.

Re: Cluster active member lost R81.20 Take 98

the_rock — Thu, 31 Jul 2025 14:47:13 GMT

What doies cphaprob -a if show on that member?

Andy

Re: Cluster active member lost R81.20 Take 98

Fatalis — Thu, 31 Jul 2025 15:54:57 GMT

Resolved the issue
The new members pulled a default local license during setup 192.168.1.1

re-attached the correct license and all seems normal now!

Thank you for replying so quickly

Re: Cluster active member lost R81.20 Take 98

Fatalis — Thu, 31 Jul 2025 15:58:21 GMT

All interfaces are up and running but looks like the new members pulled a default local license during setup. Updated the correct license information and all seems to be running correctly now.

Thank you for the quick response!

Re: Cluster active member lost R81.20 Take 98

the_rock — Thu, 31 Jul 2025 16:22:33 GMT

Hey @Fatalis

If you are allowed to do remote, happy to assist. Im busy with large project converting from Fortigate to CP, but since Im way ahead of schedule, have time to spare. Let me know.

Andy

Re: Cluster active member lost R81.20 Take 98

Fatalis — Thu, 31 Jul 2025 16:42:37 GMT

The new member pulled a default local license during setup. That local license was generated against its default interface IP (192.168.1.1).

Solution:
Re‑generating the license with the new IP which seems to have resolved the issue

Re: Cluster active member lost R81.20 Take 98

Fatalis — Thu, 31 Jul 2025 19:08:17 GMT

Corresponding issue for anti-spoofing:

An Interface was duplicated from an existing setup.
Re-configured interface with correct network.

Re: Cluster active member lost R81.20 Take 98

the_rock — Thu, 31 Jul 2025 19:08:50 GMT

Excellent job!