topic Re: R80.20 Cluster Load sharing issue in Firewall and Security Management

R80.20 Cluster Load sharing issue

Prabulingam_N1 — Sat, 18 Jan 2020 12:09:11 GMT

Dear CheckMates,

I ran into below issue for customer using Loadsharing mode.

1) Mgmt Server in R80.20 Smart appliance with latest JHF_Take_118

(followed sk162637) - (No IPSec blade enabled)

2) FW Clusters in R80.20 with JHF_Take_118 as well (5800 appliances)

a)When we use Cluster Load sharing - Multicast - All working fine

b)When we use Cluster Load sharing - Unicast (without VMAC) - All working fine

c)When we use Cluster Load sharing - Unicast (with VMAC) - Complete halt of traffic.

Even Pivot member unable to reach default gateway IP and their production halted. (So reverted to HA mode)

The above scenario I had tested in my lab environment and faced exactly same issue.

Loadsharing Unicast (without VMAC) & Multicast works fine post JHF_Take_118 on both Mgmt server & FWs.

But when LS-with VMAC option = stops working.

Any one had faced such scenario?

(I haven't tried the above LS in R80.30 for now - will check that as well)

Regards, Prabulingam.N

Re: R80.20 Cluster Load sharing issue

HeikoAnkenbrand — Sat, 18 Jan 2020 16:41:13 GMT

I would not use LS mode. It doesn't really give you an advantage. From years of experience I recommend HA mode to many of our customers. There you can discuss many advantages and disadvantages.

I would open a TAC case here.

Tip

Here you will find an interesting collection of commands to debug this issue:

R80.x - cheat sheet - ClusterXL

Re: R80.20 Cluster Load sharing issue

PhoneBoy — Sat, 18 Jan 2020 19:06:44 GMT

Best to engage with the TAC on this.

Re: R80.20 Cluster Load sharing issue

Prabulingam_N1 — Mon, 20 Jan 2020 05:02:25 GMT

Hello Heiko/Phoneboy,

Opening TAC case not a problem at all.

I have suggested customer to use LS-Multicast or LS-Unicast without VMAC as per my lab result.

But prior to that I'm thinking if this could any chance be "Limitation on LS mode usage with VMAC"

Not sure if any of CheckMates have faced or tried in their setup.

Regards, Prabulingam.N