activ/passiv-cluster police in sync but different rule handling

[kdd]

Hi everyone,

some trouble if i turn the activ one to the passiv and vice versa. the policy was syncronized but the result was different.

Same rule and same source / destination and same App (ssh). in the unsuccessful log i can't either see session- id or outbound-interface.

successful

unsuccesful

both ports are identically configured and are up. I appreciated any assistance.

cheers Klaus

[HULK]

Hello Klaus,

Could you please check the routing table, if there is a valid route available through ethernet-1/5 for destination and sequence of the security policy on policy table. If possible, bring the Unix-admin rule in the top and verify the result.

CLI command > test security-policy-match source destination destination-port protocol.

Thanks

[kdd · Accepted solution]

Hi Hulk,

all rules using FQDN generate fqdn request and this in cooperation with service route ( external-IF / untrust ) didn't work on the passiv firewall because this interface weren't up and no dns-request couldn't be satisfied.

Then it turned into activ-mode but the dns-refresh takes about 30 minutes ( or cli: request system fqdn refresh)

So to solve the problem i had to adjust the policy or and this is easier the service route (Mgmt-IF). Thanks for your support.

Regards Klaus