Cluster inconsistency after policy installation

[MasterChief117]

Hello guys

We have noticed that after upgrading from R80.30 to R81.10 two of our clusters behave erratically after policy installation. The primary will remain as active(F) which believing the secondary is in standby while the secondary shows itself as active and the primary as Lost. This will go on for 4-5 minutes until both members converge in the correct state. cphaprob says that there are no ccp sent in the sync interface however tcpdump says otherwise

I noticed that the output of the following parameters is different on both members

[Expert@GW-01:0]# fw ctl get int fwha_mac_magic

fwha_mac_magic = 254

[Expert@GW-01:0]# fw ctl get int fwha_mac_forward_magic

fwha_mac_forward_magic = 253

[Expert@GW-02:0]# fw ctl get int fwha_mac_magic

fwha_mac_magic = 1

[Expert@GW-02:0]# fw ctl get int fwha_mac_forward_magic

fwha_mac_forward_magic = 254

Are this still relevant in R81.10, I have a case open with tac however it has been lagging so any opinion would be helpful

[MasterChief117]

There is no mention of the above parameters in fwkern.conf

[charlokt]

Hello,

The update of both members of the cluster was carried out in my client after some interfaces were debugged at the switch level that made a flapping / delay in cascade.

5 were disabled and the problem could be identified. The speed was also forced to 1000baseT/Full on the switch.

The synchronization interface is more stable since it continues to generate every 6 to 7 hours.

The client has decided to request to change that switch through which the synchronization interfaces pass.

So far it has been possible to update to R81.10 with take 66 and the cluster is stable with failover every 7 hours until my client changes the switch.

I was also able to analyze that when hotfix 66 was installed, a member was left with a different number:

[Chris_Atkinson]

Please contact TAC to discuss the process for aligning CFU on the second member to Take 19.

If the issue persist in future you may need to validate that internet access is working as expected for the standby machine.