topic Re: Virtual systems failover after policy installation in Firewall and Security Management

Virtual systems failover after policy installation

vikupoi_123 — Sat, 15 Feb 2020 15:59:38 GMT

When we are doing policy installations in the particular VS of VSX gateway. That VS failover is happening..

Re: Virtual systems failover after policy installation

Chris_Atkinson — Sun, 16 Feb 2020 10:04:11 GMT

Do you observe any corresponding CUL messages?

I would suggest sharing further information (including version/JHF level) with TAC to investigate the issue further.

Re: Virtual systems failover after policy installation

Kaspars_Zibarts — Tue, 18 Feb 2020 09:23:09 GMT

We had a "very busy" VS that was impossible to push during day time / peak hour.

Then we separated fwk and rest of the processes on that VS using affinity and all started working OK

fw ctl affinity -l

....

VS_10: CPU 1 21
VS_10 fwk: CPU 13 14 15 33 34 35

so you can see that 6 cores are used only for fwk workers and two (1 and 21) for all other purposes including policy push handling.

But as mentioned earlier you need to supply more info with logs etc, could be something totally different

Re: Virtual systems failover after policy installation

vikupoi_123 — Sun, 10 May 2020 10:20:42 GMT

Hi Kaspars ,
Sorry for inconvenience for delay response we have VS1 failover at the time of policy installation . Please find the aoutput of "fw ctl affinity -l" and highlight the issue if have ...

[Expert@GWvsx1:0]# fw ctl affinity -l
eth1-04: CPU 2
eth2-01: CPU 0
eth2-02: CPU 3
eth2-03: CPU 4
Mgmt: CPU 0
Sync: CPU 0
VS_0 fwk: CPU 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
VS_1 fwk: CPU 10 11 12 13 14 15 16 17 18 19
VS_2 fwk: CPU 10 11 12 13 14 15 16 17 18 19
Interface eth1-02: has multi queue enabled
Interface eth1-03: has multi queue enabled

Re: Virtual systems failover after policy installation

Chris_Atkinson — Sun, 10 May 2020 12:22:45 GMT

Out of interest is this an R80.20 VSX gateway?

Re: Virtual systems failover after policy installation

vikupoi_123 — Sun, 10 May 2020 12:36:22 GMT

No it is R77.20 GW

Re: Virtual systems failover after policy installation

PhoneBoy — Sun, 10 May 2020 22:48:37 GMT

R77.20 has been End of Support for quite a while now.
Recommend upgrading to a supported release.