topic Re: Broadcasts on Quantum Edge VNF in Spark Firewall (SMB)

Broadcasts on Quantum Edge VNF

HolgerHartwig — Thu, 21 Apr 2022 07:33:50 GMT

Hi,

we use a Quantum Edge VNF on a VMWare SD WAN Edge. Everything seems to work. However, the broadcasts no longer arrive at the IP Helper.

In the log we found this:
fwconn_ent_early_expiration: [now=1649416396] conn <dir 1, 0.0.0.0:68 -> 255.255.255.255:67 IPP 17> reached early expiration;
fwconn_ent_eligible_for_del : conn <dir 1, 0.0.0.0:68 -> 255.255.255.255:67 IPP 17> is eligible for deletion;

Does anyone have an explanation for this?

Re: Broadcasts on Quantum Edge VNF

Chris_Atkinson — Mon, 25 Apr 2022 14:13:57 GMT

Hi - Is R80.20.35 used here or another/earlier version?

Re: Broadcasts on Quantum Edge VNF

HolgerHartwig — Mon, 25 Apr 2022 14:28:52 GMT

Hi Chris,
we use R80.20.35 (992002577), we have also tried R80.20.15 but with the same problem.

Re: Broadcasts on Quantum Edge VNF

Chris_Atkinson — Mon, 25 Apr 2022 15:20:59 GMT

To confirm is the DHCP traffic specifically allowed in your policy and which objects were used here?

Re: Broadcasts on Quantum Edge VNF

HolgerHartwig — Tue, 26 Apr 2022 07:40:15 GMT

Hi Chris,

just checked with our customer: Yes, there is a matching rule for DHCP inbound and outbound. We also tried disabling the setting "Accept incoming traffic to DHCP and DNS services of gateways" but nothing changed.

As always the packets show as allowed but it is not working. After removing VNF it starts to work immediately.

Re: Broadcasts on Quantum Edge VNF

Chris_Atkinson — Tue, 26 Apr 2022 09:01:59 GMT

Understood, with reference to the below do the rules look like those in sk104114 or something different?

If the problem persists there after please investigate further with assistance from TAC.

Re: Broadcasts on Quantum Edge VNF

HolgerHartwig — Wed, 27 Apr 2022 06:55:12 GMT

Good Morning Chris,

it turned out that there's a bug in VMWare's SD WAN Edge software.

Switching to an older version removes all problems.

VMWare is already working on it.

Thanks for your help!!!