topic Re: connectivity issue when firewall HA failover in General Topics

connectivity issue when firewall HA failover

ateo — Tue, 18 Jun 2013 04:00:11 GMT

Did anyone encounter such issue?

We noticed that whenever the firewall triggered a failover (FW1 to FW2).

external services seem to be disrupted.

eg1 :Gomes monitoring informed of connection/performance issues (though we test from some countries to be ok)

eg 2: FTP services from various country reported connection problem (China, Taiwan)

But when we revert back to the FW from 2 to 1(Origin) all services return back to norm.

Please advice..

Re: connectivity issue when firewall HA failover

Gregoux — Tue, 18 Jun 2013 06:04:02 GMT

witch monitoring did you implement and what are your interface config vwire or other?

Re: connectivity issue when firewall HA failover

ateo — Tue, 18 Jun 2013 06:44:36 GMT

Link monitoring enable on the active ethernet interface.

Failure Condition : Any

Re: connectivity issue when firewall HA failover

Gregoux — Tue, 18 Jun 2013 07:15:10 GMT

ok it seams to be a routing issue.

for the monitoring try to use a path monitoring and see what append if you trigger a failover, normaly a revert to good appliance should be triggered automatiquely

if the comportement is like that you have to resolve your routing issue first.

Re: connectivity issue when firewall HA failover

ateo — Tue, 18 Jun 2013 07:31:19 GMT

Thanks..

FW1 work perfectly ok, issue only arise when failover to the FW2.

Both are running the same config/path/routes...

How would it be a routing issue?

Re: connectivity issue when firewall HA failover

Gregoux — Tue, 18 Jun 2013 08:58:35 GMT

are you in vwire config?

in that case have a look there https://live.paloaltonetworks.com/message/1628#1628

if you are in L3 config verify routing from your FW2 with path monitoring