mdplan and dplan- SMART-1 cloud

[sahmad]

Hello everyone, 

Reaching out to see if anyone can help as I pretty much giveup on TAC and myself too. We have CP 3000 (R81.10 JHF 110) cluster that we manage through on Prem Policy Manager. Cluster has separate mplan and dplan. During the migration everything went well except SIC communication to the cloud. It can't establish SIC communication. We involved TAC 3 months ago and it has been struggle. Here is what it boils down to. TAC suggested to disable dplan/mplan separation. We did disable but by doing so, the firewalls stopped talking to internet. Upon further inverstigation we found that after disabling dplan/mplan, the firewalls wont even talk to local DNS and wont even PING. I understand that enabling mdps create separate routing table etc but need to understand few things.
Please  
1: Why Gateways can't talk to SMART-1 cloud when dplan/mplan is enabled. Even though I can ping internet, DNS etc it still can't establish SIC communication.
2: When I disable dplan/mplan separation, why firewalls stop talking to internet and local DNS server. 
3: Am I dealing with some documented bug? like I should be able to establish SIC with SAMRT 1 while dplan/mplan is enabled. No?

This issue is going on from last 3 months and as I stated TAC is not very helpful. Looking for feedback/suggestion from those who were able to establish SIC when dplan/mplan separation is enabled or workaround

Thank you 

[_Val_]

Hi Sheraz, could you please send me the SR via a private message? Also, during the process and struggle with TAC, did you escalate your case? 

[_Val_]

In addition, concerning your question number 3. It looks to me a configuration issue. With management Plane enabled, you have two VRFs, one of them taking care of FW operations and connectivity, and the MP in charge of admin/log/management traffic. As you mentioned, both planes have separate routing tables and DNS definitions. When MP admin traffic stays internal, there is no issue. Once you need to reach out to Internet, there is most probably a routing issue, since MP should actually pass through the data plane to reach Internet IPs. 

Disamping MP separation makes sense, and you need just to figure out why you lose direct internet connectivity. My bet is, that is because you lose DNS and routing settings from MP, and you just need to re-create them. 

That said, it is not exactly easy to provide you with any guidance without details.