topic Re: no traffic flow with IPv6 and all SGMs active in Hyperscale Firewall (Maestro)

no traffic flow with IPv6 and all SGMs active

Wolfgang — Wed, 10 May 2023 19:21:36 GMT

Our journey to IPv6 with Maestro will be an endless story….

At this time we are on R81.10 Jumbo take 94. IPv6 traffic to and from our VSX virtual systems are working fine, but no packetflow through the virtual systems. Debugs shows the packets are lost somewhere in the Maestro environment. Last night we did some other checks to debug another problem and we stopped all SGMs except one. Surprise surprise….., now we can see IPv6 traffic going through all our virtual systems. Setting one additional SGM active stops all IPv6 traffic, maybe a problem with the distribution….

TAC case is open and they suggest to install Jumbo take 95. But we are not happy with not recommended Jumbos. Take 95 includes :

PRJ-44881, PMTR-86526 After an upgrade, local IPv6 traffic from Active members may fail.

Can someone confirm that our problem will be solved with Jumbo take 95? Anyone using IPv6 with Maestro?

Re: no traffic flow with IPv6 and all SGMs active

PhoneBoy — Wed, 10 May 2023 21:41:51 GMT

It sounds promising.
Has TAC explained the nature of the bug and how it applies in your specific case?

Re: no traffic flow with IPv6 and all SGMs active

Wolfgang — Thu, 11 May 2023 05:16:25 GMT

No. We mentioned that the bug is described "local IPv6 traffic from Active members may fail", but we have no problem with traffic from gateway. TAC said it's more an general IPv6 problem then described in the jumbos release notes.

Re: no traffic flow with IPv6 and all SGMs active

Olegf — Thu, 11 May 2023 08:32:10 GMT

Hi,

Do you have the following messages in fwk.elg:
[vs_0];[tid_1];[fw4_1];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1;

It's one of the symptoms that PRJ-44881, PMTR-86526 fixes.

EDIT:
On second thought, I believe that you need to install the fix anyway because you have IPv6 traffic.
In addition, I think that it will solve your issue.

Re: no traffic flow with IPv6 and all SGMs active

Danny — Thu, 11 May 2023 10:03:16 GMT

sk180634 describes that IPv6 neighbor solicitation may fail on some SGMs.
Until installation of JHF Take 95 you can set static static IP neighbor entries as workaround:

add neighbor-entry ipv6-address x:x:x:x:x:x:x:x macaddress yy:yy:yy:yy:yy:yy interface zzzzz

Re: no traffic flow with IPv6 and all SGMs active

Wolfgang — Thu, 11 May 2023 14:45:34 GMT

We can see such entries

[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1
[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1
[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1
[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1
[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1
[11 May 15:46:33][fw4_0];[vs_0];FW-1: fw_drv_is_if_type_ex_by_ifn: illegal ifn: -1

I believe take 95 is needed 😞