topic Re: vsec Standby Connectivity Issue After r80.40 Upgrade in Firewall and Security Management

vsec Standby Connectivity Issue After r80.40 Upgrade

StackCap43382 — Wed, 28 Oct 2020 09:18:26 GMT

Hi All,

An Azure VSEC cluster has been upgraded to r80.40 and we are not able to failover between members.

Checking connectivity we are unable resolve DNS on reach any external entity from the standby.

Further investigations show the standby using the sync (eth1) to send it via primary.
The primary is then sending the connection out its public (eth0) and folding behind the cluster address.

Response traffic is being folded back to the correct IP but then routed out of eth0 and oblivion.

Internal Interface: Eth1
External Interface: Eth0
Sync link: Eth1

fwha_forw_packet_to_not_active=0
fwha_cluster_hide_active_only = 1
fwha_silent_standby_mode = 0

SKs:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk93204
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169154

Before I shove more ports into table.def, anyone else seen this?

Re: vsec Standby Connectivity Issue After r80.40 Upgrade

Data_Center — Wed, 28 Oct 2020 11:35:17 GMT

Hi,
Can you kindly share the output of '$FWDIR/scripts/azure_ha_test.py'
Both members active&standby

Thanks,

Noy

Re: vsec Standby Connectivity Issue After r80.40 Upgrade

StackCap43382 — Fri, 30 Oct 2020 12:32:03 GMT

Fix was eth0 was not configured as SYNC+Cluster in the cluster object so Standby was black holing return traffic pivoting via Active.

Re: vsec Standby Connectivity Issue After r80.40 Upgrade

Data_Center — Sat, 31 Oct 2020 18:22:26 GMT

Great,

thanks for the update.