Dropping traffic on HA Sync Interface

[SnafuNL]

I've got two 1590 appliances running in a cluster, but I can't seem to get the HA working as expected. One of the cluster members always has a status of inactive.

Noticing in the Security Log of the active member dropped traffic on the Sync interface (the two appliances are directly connected), and I'm guessing this is at least part of the problem. Do I need to put a rule in place to allow this traffic or is something else happening?

Running R81.10.17

Thanks

[sigal]

Hi,
Can you please share the output of:

cphaprob stat

From both cluster members?

Thanks.

[SnafuNL]

---

Cluster Mode: High Availability (Active Up)

Sync Mode: Optimized Sync

ID Unique Address Assigned Load State

1 10.231.149.1 100% ACTIVE
2 (local) 10.231.149.2 0% DOWN

Active PNOTEs: FSYNC

Last member state change event:
Event Code: CLUS-112100
State change: INIT -> DOWN
Reason for state change: FULLSYNC PNOTE
Event time: Tue Mar 31 10:01:58 2026

Cluster failover count:
Failover counter: 0
Time of counter reset: Tue Mar 31 07:29:25 2026 (reboot)

Cluster Mode: High Availability (Active Up)

Sync Mode: Optimized Sync

ID Unique Address Assigned Load State

1 (local) 10.231.149.1 100% ACTIVE
2 10.231.149.2 0% DOWN

Active PNOTEs: None

Last member state change event:
Event Code: CLUS-114904
State change: ACTIVE(!) -> ACTIVE
Reason for state change: Reason for ACTIVE! alert has been resolved
Event time: Tue Mar 31 10:01:43 2026

Cluster failover count:
Failover counter: 0
Time of counter reset: Mon Mar 30 05:17:42 2026 (reboot)

[sigal · Accepted solution]

If your Firewall policy is set to Strict mode then I suggest allowing the traffic between the two cluster members.
This issue has been fixed in R82.00.10, which I understand you cannot upgrade to since you are using 1590.
If adding this rule is extremely inconvenient then you can open SR and we will try to back-port the fix to R81.10.17.

[SnafuNL]

Thank you. The rule resolved the issue. Both are in Active/Standby now.

[the_rock]

Glad it worked.

[the_rock]

Mind also sending below?

cphaprob -a if

cphaprob -i list

cphaprob -l list