Cluster active member lost R81.20 Take 98

[Fatalis]

Following a recent replacement of the firewall cluster hardware and re‑IP of the cluster members, the standby member is reporting as Normal in SmartConsole, while the active member is displaying a “Lost” status.

Both members are reachable via SSH, and cphaprob stat indicates that the cluster members are powered on and appear healthy from the command line. ClusterXL traffic between members is also confirmed to be flowing normally, suggesting that synchronization is occurring.

However, logs from other connected systems began reporting anti‑spoofing drops shortly after the change.

Will test SIC re-establishment and fw unloadlocal next. Also users report successful traffic.

[Lesley]

SIC is not working with the active member. This is not related to clustering. You have to check why SIC is not working. This is the communication between mgmt and fw. If you see spoofing drops maybe this SIC traffic is also dropped. Start with a quick drop check: fw ctl zdebug + drop | grep IP mgmt on the fw-a when you press SIC test in Smart Console. 

[Fatalis]

Resolved the issue 
The new members pulled a default local license during setup 192.168.1.1

re-attached the correct license and all seems normal now!

Thank you for replying so quickly

[the_rock]

What doies cphaprob -a if show on that member?

Andy

[Fatalis]

All interfaces are up and running but looks like the new members pulled a default local license during setup. Updated the correct license information and all seems to be running correctly now.

Thank you for the quick response!

[the_rock]

Hey @Fatalis 

If you are allowed to do remote, happy to assist. Im busy with large project converting from Fortigate to CP, but since Im way ahead of schedule, have time to spare. Let me know.

Andy

[Fatalis · Accepted solution]

The new member pulled a default local license during setup. That local license was generated against its default interface IP (192.168.1.1).

Solution:
Re‑generating the license with the new IP which seems to have resolved the issue

[Fatalis]

Corresponding issue for anti-spoofing:

An Interface was duplicated from an existing setup.
Re-configured interface with correct network.

[the_rock]

Excellent job!