topic Re: upgrading security gateways in a cluster from R77.30 to R80.20 in General Topics

upgrading security gateways in a cluster from R77.30 to R80.20

Kamiar_Sh — Mon, 19 Aug 2019 16:59:58 GMT

Hi All,

I have upgraded my cluster R77.30 to R80.20 last week and I faced an issue after upgrading as follow:

Unix server couldn`t send files to FTP server via FTP passive mode and after 2, 3 hours troubleshooting I disabled the SecureXL and issue resolved so do you have any suggestion or thought?

Thanks

Re: upgrading security gateways in a cluster from R77.30 to R80.20

HelioLeite — Mon, 19 Aug 2019 17:15:18 GMT

are there asymmetric traffic in this environment or Anti-Virus or IPS blade enabled in this environment to inspect FTP traffic?

Re: upgrading security gateways in a cluster from R77.30 to R80.20

Kamiar_Sh — Mon, 19 Aug 2019 17:24:40 GMT

after upgrading IPS was enabled but his act was only detect then I disabled it for time being

Re: upgrading security gateways in a cluster from R77.30 to R80.20

HelioLeite — Mon, 19 Aug 2019 18:12:55 GMT

I saw a similar problem with terminal services, are there any symptom occurred on sk147093?

Kernel debug (fw ctl zdebug + drop) shows the following packet drops:
[DATE TIME];[kern];[tid_0];[SIM-206609312];update_tcp_state: invalid state detected (current state: 0x10000, th_flags=0x14, cdir=1) -> dropping packet, conn: [<SrouceIP,SourcePort,DestinationIP,DestinationPort,6>][PPK0];
[DATE TIME];[kern];[tid_0];[SIM-206609312];do_inbound: Possible TCP state violation for <SrouceIP,SourcePort,DestinationIP,DestinationPort,6> -> dropping packet ;
[DATE TIME];[kern];[tid_0];[SIM-206609312];do_packet_finish: SIMPKT_IN_DROP vsid=10, conn:<SrouceIP,SourcePort,DestinationIP,DestinationPort,6>;

Issue does not replicate when SecureXL is off.

Re: upgrading security gateways in a cluster from R77.30 to R80.20

PhoneBoy — Tue, 20 Aug 2019 17:49:06 GMT

Anytime disabling SecureXL "solves" a problem, open a TAC case.

Re: upgrading security gateways in a cluster from R77.30 to R80.20

Kamiar_Sh — Wed, 06 Nov 2019 19:16:53 GMT

Hi All,

I want to share the solution that fixed my issue:

# fw ctl set int asm_allow_syn_with_data 1

but if you want it as permanent solution the kernel file should be modified and gateway should be rebooted