topic traffic to standby node is dropped by anti spoofing in General Topics

traffic to standby node is dropped by anti spoofing

KM1895 — Thu, 11 Mar 2021 12:56:15 GMT

hi,

i have a situation, where some traffic towards a standby node in a cluster is dropped by anti spoofing.

ICMP and SNMP is being dropped by anti spoofing,

The traffic is being sent over vpn, and there are about 10-15 other locations with this set up, and it works just fine there.

Not sure if this is a version bug, it is running r80.20 with no jumbo. Other locations are mainly r80.30 and .40, with a few r80.10 and r77.30.

fw ctl set int fwha_forw_packet_to_not_active has been set to 1 on both cluster members, and i can access the standby node on ssh without any issue, its just the other traffic being dropped. Traffic to the active node works just fine.

Has anyone seen anything similar before, and have any valuable input?

Re: traffic to standby node is dropped by anti spoofing

PhoneBoy — Thu, 11 Mar 2021 20:59:02 GMT

Am I understanding correctly that ICMP from an IP is getting dropped on anti-spoofing but SSH from the same IP is allowed?
That sounds like a bug.
I would ensure you have the latest recommended Jumbo Hotfix first.
If the problem still persists, raise a TAC case.

Re: traffic to standby node is dropped by anti spoofing

the_rock — Fri, 12 Mar 2021 00:14:03 GMT

Could you please attach a screenshot of the drop or output from fw ctl zdebug command? I think that would be helpful in trying to figure out why this is happening.

Andy

Re: traffic to standby node is dropped by anti spoofing

KM1895 — Fri, 12 Mar 2021 10:26:47 GMT

hi,

The icmp and snmp comes from the same address, and is dropped by antispoofing. The ssh is from another address, but that kinda proves the forward to not active parameter is working.

What i find really weird, is that i did some more troubleshooting today, and while the smartconsole logs clearly states antispoofing and drop, this never shows up on the cluster members when i do fw ctl zdebug drop on both of them.

Im starting to lean towards some kind of bug here, and we are in the planning process of doing an upgrade to R80.40, which will hopefully solve this issue.