Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
tpattgeek
Explorer
Jump to solution

Standby Cluster Member cannot reach the Internet

Hi all,

 

I recently deployed a cluster for a customer with a fresh R80.30 install for both virtual MGMT and 3100 gateways.  We cut over from a single appliance to the cluster which connects via layer 2 to a cable modem.  VRRP is working fine, but the standby member is failing to reach the Internet.  All routes are the same and valid, but the standby arp table only shows the inside next hop and the outside VIP.  After checking the logs, I see the standby is hitting the policy and being blocked (since there are no rules in the policy to allow the gateways' public IPs.  It is showing the source of all traffic as coming from the standby's physical external IP.

I checked all of the common SKs and it seems like THIS - sk43807 may be the most promising one.

Is the recommended fix to implement all of the steps from this SK in order?

Since it only bypasses hide NAT for the specific ports, how do you resolve ICMP failures from the standby member?

The option for using a virtual MAC is unchecked; should that always be enabled, especially with a cable modem?

The reason I mention the virtual MAC is because I attempted to fail over to the standby as a means to test this, and all connectivity was lost.  The standby assumed Active role, but no connectivity was allowed through the device, that is why I'm thinking there are multiple adjustments needed.  I added a rule to allow the standby gateway through the policy, and connectivity was restored to the standby unit, but I don't believe that is the proper fix... Any help is appreciated!

 

0 Kudos
6 Replies
This widget could not be displayed.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events