topic Re: Maestro r81.20 Take53 dynamic balancing policy installation issues in Hyperscale Firewall (Maestro)

Maestro r81.20 Take53 dynamic balancing policy installation issues

Lloyd_Braun — Tue, 20 Aug 2024 17:57:30 GMT

Has anyone encountered issues with loss of connection state during policy installation to a Maestro cluster where the SGMs have mismatched dynamic coreXL allocations?

The main problematic traffic is SIP control connections that are very long lived. A chassis_admin failover to the standby site restores connectivity. Since the standby site starts with consistent coreXL splits across the SGMs, it makes me suspicious of the coreXL split mismatch resulting from the dynamic balancing functionality. We have another datacenter with very similar traffic profile that runs the same policy and similar maestro config, but dynamic balancing is not enabled there. That site has no issues when policy is installed.

Re: Maestro r81.20 Take53 dynamic balancing policy installation issues

Lesley — Tue, 20 Aug 2024 19:00:34 GMT

What setting you have here under the relevant SmartConsole firewall object?

Open FW object -> Other -> Connection Persistance.

And the relevant SIP services and other used in the firewall rule. -> find the services in object list. Open and go to advanced. In here you have setting ''Keep connections open after policy has been installed"

Re: Maestro r81.20 Take53 dynamic balancing policy installation issues

AkosBakos — Tue, 20 Aug 2024 20:12:37 GMT

Hi @Lloyd_Braun

And one more useful tip: change the SIP port to simple UDP/5060 without protocol detection.

Akos

Re: Maestro r81.20 Take53 dynamic balancing policy installation issues

Lloyd_Braun — Tue, 03 Sep 2024 20:40:52 GMT

This was in issue related to hyper flow sk181671. Fixed with JHF 54.