Security gateway dispatched from Security Group ,if MHO-1 connection failed but MHO-2 connection ok

[anwar999]

In our deployment we have two MHO and 5 security gateway. We have connected all the gateway to both MHO with checkpoint DAC cable. all are looks good and production ongoing. But we faced an issue that one gateway is dispatched from security group due to no connectivity with MHO-01 but the connectivity with MHO-02 is okay.

As we know MHO work active active why it wasn't working with second MHO ?
Anybody knows any issue regarding this??
TIA

[Dario_Perez]

What do you mean with "But we faced an issue that one gateway is dispatched from security group due to no connectivity with MHO-01 but the connectivity with MHO-02 is okay." is connected or not to both MHO?

[anwar999]

When the connectivity loss from first MHO then the gateway dispatched from security group but on this moment mentioned gateway is connected with second MHO. So the gateway only connected with second MHO then problem happens. Is it required to connected in both MHO at a time?

[Dario_Perez]

do you have the both MHO connected as a bond on security group? or each port are independent each other. 

[anwar999]

We have a magg interface on security group and members from MHO1 and MHO2 as bond.
Also all the data ports are bond from both MHO.

[emmap]

If an SGM loses connectivity to an MHO, it will go into a Down state. This is expected behaviour. Reason being that it no longer has any connectivity to the uplinks on MHO1. As the network is still going to send packets into this uplink and no production traffic ever crosses the MHO Sync link, the SGM must go Down, else some production traffic will be lost. 

If the whole MHO goes down, SGMs remain up, as all the uplinks on the down MHO will be down so there will be no traffic on them anyway.

[anwar999]

So this is not active active architecture of MHO correct? If primary MHO goes down fully then all traffic will move to second MHO? 

[emmap]

MHOs are not clustered like gateways. You achieve HA across two MHOs by configuring all your uplinks as bonds with interfaces across both MHOs and connecting downlinks from each SGM to both MHOs. If an MHO goes down, those bonded uplinks do as they are configured according to the bond type. Typically LACP would have been used so as far as the SGMs and your switches are concerned, half the bond is down but the other half is still there so we send packets that way. Downlinks simply carry packets according to which MHO houses the interface that the packet comes in on or is sent out on, according to routing and bond settings. 

Hence MHOs are a kind of active/active, but if you think of them as big line cards in a single gateway that is the security group you'll have a clearer understanding.

[Shajahan]

The bond interface connects uplinks from both the primary and secondary MHO. Traffic can be handled by both MHOs, so why does a failure occur when there is a problem with the primary MHO DAC cable?

[emmap]

Because the uplink is still up. If the SGM was still Active with no connection to the MHO, the packets that would be distributed to it that come down that uplink would have nowhere to go. We don't want to mess with re-routing them and adding complexity and latency, so the SGM goes down instead.

Yes we could 'just' pivot them over to the other MHO via some link or other (and overload the sync link), or we could 'just' change distribution on one MHO and not the other MHO (no we can't because packets from the same flow would go to different SGMs and then need correcting or they'd just be dropped anyway), or we could 'just' do something else.. but all of that is a lot of work and coding and packet handling to manage a rarely seen edge case. Downlinks should never just go down, there's no maintenance scenario where a single downlink would go down, and DACs very rarely fail, so we'd just rather take the reliable option of setting the SGM down until the fault is resolved. 

[Shajahan]

Thanks for your helpful response. I am wondering why we are connected to 2 MHO if the primary MHO SGM cable fails and the secondary MHO can't handle the traffic.

[emmap]

That's not how it works. Both MHOs are handling traffic if your uplink bonds are configured that way. If the downlink from MHO1 to SGM3 goes down, SGM3 will go down due to the explanation above. SGM1 and SGM2 will still be receiving and sending packets through both MHOs. 

You can also have dual-downlinks between each MHO and SGM, if you're concerned about redundancy here. If one of the downlink cables is unplugged, the SGM remains up because still has the other downlink connected to that MHO.

If MHO1 itself goes down, all SGMs remain up. This is because all the uplinks connected to MHO1 are also down so there's no packet handling issue as they are all going through MHO2 (if your uplinks are done properly).