topic R81.20, Network Feed, Maestro in Hyperscale Firewall (Maestro)

R81.20, Network Feed, Maestro

vinceneil666 — Tue, 09 May 2023 09:03:46 GMT

Hi,

We have a security group, with 4 members, where the members sometime will leave the cluster - only to rejoin after 3-5 seconds. (this is a ongoing TAC ticket, with tons of debug and work beeing done by several people in CP)

looking at different debugs, and trying to pinpoint the issue - I keep comming back to the network feeds we have implemented. (That is also why we are running R81.20). I am as of now not able to disable the network feeds, due to services beeing heavily interupted.

But I was wondering if anyone else operating a Maestro setup have had similar issues ? Anyone with issues realted to Maestro, r81.20 and network feeds ???

Re: R81.20, Network Feed, Maestro

Dario_Perez — Tue, 09 May 2023 13:33:06 GMT

this environment is fresh install or upgrade?

in both cases please share the deployment agent version. for Security Group and for Orchestrator

I don't think IOC Feed is the reason why SGM leave the security group.

I think TAC is the best way to address the issue.

Re: R81.20, Network Feed, Maestro

Danny — Tue, 09 May 2023 22:48:33 GMT

Let's verify a couple things on your SMO (expert mode):

g_fw -a -b all ctl get int mbs_max_members_for_port_range

g_fw -a ctl get int mbs_max_sites_for_port_range

g_all -a cat /proc/sys/net/ipv4/ip_local_port_range

Re: R81.20, Network Feed, Maestro

Daniel_Szydelko — Thu, 11 May 2023 05:42:58 GMT

Hi Danny,

Can you elaborate what these commands check, please?

Daniel.

Re: R81.20, Network Feed, Maestro

Danny — Thu, 11 May 2023 09:40:03 GMT

They verify if the port range is correctly distributed between the four SGMs.
The output of the last command should look similar to this:

1_01: 32768 40958 1_02: 40959 49149 1_03: 49150 57340 1_04: 57341 65531