topic Re: VSX VSLS no Standby in Firewall and Security Management

VSX VSLS no Standby

Lau — Thu, 02 Oct 2025 09:28:18 GMT

Hi everyone,

I have a strange issue that will most likely require a TAC case but I though that I would ask here as well if anyone has seen the issue before and might have a quick solution.

After upgrading a 9800 VSX VSLS cluster with 4 members to R81.20 JHF take 115 (recommended by TAC as we had several issues running the previous takes) one VS has some strange status issues in cphaprob stat.

This is the output from VS0:

This is the output from VS9 itself:

ID Unique Address Assigned Load State Name

1 x.x.x.x 100% ACTIVE xxx
2 y.y.y.y 0% BACKUP yyy
3 (local) z.z.z.z 0% BACKUP zzz
4 a.a.a.a 0% BACKUP aaa

I cannot understand why there is no Standby and only Backups.

Checking the connection table on all 4 members I can see sync is working correctly between member 1 and member 3, which is the member that should be standby according to the VSLS priority list. It also works to do a manual failover with intact state table and no network disruptions. So it is only cosmetic.

I have not tried to run reset_gw and reconfigure, only pushing the VSLS configuration again which did not solve it. Normal fw policy did nothing either.

So, any ideas as I wait for TAC?

Regards,

Lau

Re: VSX VSLS no Standby

Oliver_Fink — Thu, 02 Oct 2025 10:28:13 GMT

Maybe a dumb suggestion: But have you tried to install policy with non-accelerated install?

Re: VSX VSLS no Standby

Lau — Thu, 02 Oct 2025 10:43:48 GMT

I hadn't, but tried it now with no success. Thanks for the idea though.

Re: VSX VSLS no Standby

Chris_Atkinson — Thu, 02 Oct 2025 12:09:51 GMT

HA status was ok before the update?

Anything special about the VS, any dynamic routing or bridge mode?

Re: VSX VSLS no Standby

emmap — Fri, 03 Oct 2025 01:11:43 GMT

Have you tried restarting that VS? Since the 3.1 kernel you can cpstop;cpstart per VS if you vsenv to it.