topic Re: Dropping traffic on HA Sync Interface in Spark Firewall (SMB)

Dropping traffic on HA Sync Interface

SnafuNL — Tue, 31 Mar 2026 12:49:16 GMT

I've got two 1590 appliances running in a cluster, but I can't seem to get the HA working as expected. One of the cluster members always has a status of inactive.

Noticing in the Security Log of the active member dropped traffic on the Sync interface (the two appliances are directly connected), and I'm guessing this is at least part of the problem. Do I need to put a rule in place to allow this traffic or is something else happening?

Running R81.10.17

Thanks

Re: Dropping traffic on HA Sync Interface

sigal — Tue, 31 Mar 2026 12:56:42 GMT

Hi,
Can you please share the output of:

cphaprob stat

From both cluster members?

Thanks.

Re: Dropping traffic on HA Sync Interface

SnafuNL — Tue, 31 Mar 2026 13:12:42 GMT

Cluster Mode: High Availability (Active Up)
Sync Mode: Optimized Sync
ID Unique Address Assigned Load State
1 10.231.149.1 100% ACTIVE
2 (local) 10.231.149.2 0% DOWN

Active PNOTEs: FSYNC
Last member state change event:
Event Code: CLUS-112100
State change: INIT -> DOWN
Reason for state change: FULLSYNC PNOTE
Event time: Tue Mar 31 10:01:58 2026
Cluster failover count:
Failover counter: 0
Time of counter reset: Tue Mar 31 07:29:25 2026 (reboot)
Cluster Mode: High Availability (Active Up)
Sync Mode: Optimized Sync
ID Unique Address Assigned Load State
1 (local) 10.231.149.1 100% ACTIVE
2 10.231.149.2 0% DOWN

Active PNOTEs: None
Last member state change event:
Event Code: CLUS-114904
State change: ACTIVE(!) -> ACTIVE
Reason for state change: Reason for ACTIVE! alert has been resolved
Event time: Tue Mar 31 10:01:43 2026
Cluster failover count:
Failover counter: 0
Time of counter reset: Mon Mar 30 05:17:42 2026 (reboot)

Re: Dropping traffic on HA Sync Interface

sigal — Tue, 31 Mar 2026 13:41:15 GMT

If your Firewall policy is set to Strict mode then I suggest allowing the traffic between the two cluster members.
This issue has been fixed in R82.00.10, which I understand you cannot upgrade to since you are using 1590.
If adding this rule is extremely inconvenient then you can open SR and we will try to back-port the fix to R81.10.17.

Re: Dropping traffic on HA Sync Interface

the_rock — Tue, 31 Mar 2026 13:43:40 GMT

Mind also sending below?

cphaprob -a if

cphaprob -i list

cphaprob -l list

Re: Dropping traffic on HA Sync Interface

SnafuNL — Tue, 31 Mar 2026 14:10:10 GMT

Thank you. The rule resolved the issue. Both are in Active/Standby now.

Re: Dropping traffic on HA Sync Interface

the_rock — Tue, 31 Mar 2026 19:04:44 GMT

Glad it worked.