R80.40 Cluster on Hyper-V

[Corey_Clark]

Has anyone see issues with the standby firewall communicating through active as it should when installedin Hyper-V.  I have seen this in at least 3 different clusters so far.  Traffic is seen leaving standby on sync interface, but never appears to never arrive at the active firewall. 

Thanks,

Corey  

[Chris_Atkinson]

Hi Corey,

Not aware of a Hyper-V specific behaviour myself but that doesn't mean there isn't something unique there.

Meanwhile take a look at sk169154 and see if it assists with your situation (may also require a CCP tweak in consultation with TAC).

Refer also: sk167453

[Gary_Scott]

I think this is due to hyper-V rejecting forged transmits. For a work around running fw ctl set int fwha_cluster_hide_active_only 0 per sk169154 does send the traffic out of the ext interface instead of the sync and with a no NAT rule for the cluster members traffic from the secondary now works. How can this be set to survive a reboot, fwkern.conf file with fw ctl set int fwha_cluster_hide_active_only 0 does not apply this parameter upon a reboot. 

[Chris_Atkinson]

Did you configure it like below or something else?

fwha_cluster_hide_active_only=0

[Gary_Scott]

Something else,  "fw ctl set -f int fwha_cluster_hide_active_only 0" used sk16202 as a reference. Just tried "fwha_cluster_hide_active_only=0" and that worked. Thank you! 

[Corey_Clark]

That would be my next step, just wanted to see if anyone else had experienced this behavior on hyper-v installations.

[Chris_Atkinson]

Understood, seems Gary is testing for you. 😉