Hello,
we are bulding a new Maestro environment currently and stumbled upon the following issue:
We are using dynamic routing with BGP. Each route has two next-hops, Router 1 (primary) and Router 2 (backup).
When we failover the BGP sessions from router 1 to router 2 (by manually taking down the BGP session to router 1) everything works fine. But when we want to go back to router 1, there are no routes on the firewall for the first 30 seconds after the BGP sessions becomes established (30 seconds is our configured timer for keepalive messages).
On the router (Juniper OS) we see the outgoing route-update immediately after session establishment and we also see these packets in tcpdump on the firewall. But the firewall just seems to completely ignore this first update. Only after the router sends its first keepalive the firewall suddenly also gets the advertised routes from the router.
We noticed this issue with our first security group (sg-1) with version R81.10 JHF Take 94 but I also did some tests with a new security group (sg-2) on version R81.20 JHF Take 26 and the behavior is the same.
Both security groups consist of two 6900 plus appliances and are configured as VSX.
Did anybody else notice this behavior in their environment?
I also attached information about our systems and the BGP configuration.