- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Connections after cluster failure test
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Connections after cluster failure test
Hello, can you help me? We have the following problem.
The client has an Active/Standby cluster.
When I turn off the active node, the standby normally takes over the environment.
With this action, the gateways switch function.
The node that was active becomes standby and the standby is active.
So far, no problem.
The problem occurs when I unplug the node that was previously standby and became active.
At that point, users' Internet access stops happening.
When applying policy, how the connections are reestablished.
Some information:
1. In the log, the connections appear as Accept;
2. If a user accesses a banned site, the banned access page is displayed;
3. External publications work smoothly;
4. It is possible to ping in stations that do not navigate.
5. Servers that are in the DMZ do not face the problem.
I created a rule above the web filtering rule and this host does not face the problem.
Apparently the problem has to do with user sessions.
[Expert@gw01:0]# cphaprob stat
Cluster Mode: High Availability (Active Up) with IGMP Membership
Number Unique Address Assigned Load State
1 10.255.1.18 100% Active
2 (local) 10.255.1.17 0% Standby
Local member is in current state since Tue Aug 28 14:15:10 2018
[Expert@gw02:0]# cphaprob stat
Cluster Mode: High Availability (Active Up) with IGMP Membership
Number Unique Address Assigned Load State
1 (local) 10.255.1.18 100% Active
2 10.255.1.17 0% Standby
Local member is in current state since Tue Aug 28 12:12:54 2018
Thank You
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You didn't mention the version/patch level of the gateway, which is almost always a relevant detail.
It also seems like you're using App Control/URL Filtering, but did not explicitly state this.
I would open a TAC case and have them investigate in more detail.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dameon, thank you!
