Hi Mates,
So it's been discussed a lot but my story is a little bit different. I have a client with a bunch of Active/Standby ClusterXL clusters in which the Standby member cannot access he internet at all.
Long story short: I almost ran out of search keywords in this forum and on google regarding the issue. First of all, sk43807 was followed line-by-line with no luck. then fwha_forw_packet_to_not_active 1/0 - no change at all and this is why! - please see the diagram. There is more than 1 interface but you get the picture.
Both members are running only on private IP addresses. All traffic is NAT hidden behind a public IP address and the CORE router knows to route the /32 of that public IP address to the VIP address of the cluster. When the ACTIVE node (doesn't matter, fw1 or fw2) sends any packets it's NAT-ed behind that public IP address and sent on it's way. The return traffic is forwarded by the router to the VIP which and everything works (as VIP is bounded to the Active member).
When the Standby member tries to access everything I can see (and I'm very sorry but I cannot put real captures here due to IP address privacy) that packets that originates from Standby are forwarded to the Active member over the SYNC interface. The Active member then matches the traffic to it's rulebase, applies NAT and packets go out to CORE and then to internet. The return traffic is funny. It arrives on the Active member and there vanishes. It's not dropped (fw ctl zdebug +drop) , it simple vanishes and is not forwarded to the Standby member (which is a function by design I presume).
So eventually I've lost all my hops in making this work.
Any help or guidance will really be apreciated.
Wish all the best,
