No proper policy-enforcement after installing jumbo-take 196 on top of jumbo-take 155 (R80.30, VSX)

[Martin_Peinsipp]

Hi!

We had a huge problem on a VSX-Cluster (R80.30, jumbo-take 155) after installing jumbo-take 196. After the reboot of the inactive cluster-node (cluster state was fine) we performed a manual failover ("vsx_util vsls") to this fw-node. Right after this, we had a overall taffic-outage because the policy was not enforced correctly. Most traffic was blocked based on the last clean-up-rule.

We did not have enough time time analyze the problem (fw ctl zdebug, we only checked the size of the connection-table, which was very low at this time), so we uninstalled jumbo-take 196 again. After the reboot we had the same problem on both cluster-nodes.

We had to push the policy manualy. Right after this, everything was working fine again.

Befor this procedure the cluster was working fine and we did not have any issues with failover at all.

We are already in contact with the TAC-Team.

Do you have any ideas regarding this strange behaviour?

Best regards

Martin

[G_W_Albrecht]

There are other posts already about this issue !

[Martin_Peinsipp]

Hi!

Can you share a link, I did not find similar posts.

Martin

[Chris_Atkinson]

https://community.checkpoint.com/t5/General-Topics/r80-30-take196-fw-unable-to-accept-new-connection...

[Martin_Peinsipp]

THX for the link, strange the search did not find anything related to this.

BR
Martin