Failover to passive no traffic passes

[alan.lemay]

Hi all - have been working on upgrading all our firewalls from 9.1.13 to 9.1.14 and ran into an issue last night with one of our Active/Passive 7050 pairs. When I failed over to the passive FW our users lost internet connectivity, once the active FW finished rebooting and I failed back over to it internet was restored. Configs between the 2 devices are sync'd and cabling all looks the same and is fine, each FW has 4 links divided by 2 core switches. Core switch config looks identical. Only major difference I could find between this pair and the other pairs that work is we have link groups configured on the non working pair. Have a call with TAC on Monday to troubleshoot but figured I would check here for ideas. Thanks!

[BPry]

@alan.lemay,

I'd recommend reviewing the system logs and seeing if the system actually realized that it couldn't pass traffic or not. If you don't have path monitoring enabled it's quite possible that the 7050 didn't even realize that it couldn't pass traffic; while this wouldn't have helped you in this outage, it would have at least been recorded in the system logs to help narrow down the issue.

Baring something present in the system logs, I'd really focus on making sure that the passive unit links are actually functional. Just because the configuration says things should be good doesn't mean you can't have a layer 1 issue with the cabling. It's quite possible your passive unit simply can't communicate properly to your core switches due to bad connections due to light levels if using a fiber connection or due to configuration.

Just as an FYI, I always recommend clients due a failover test at least once a month to verify that their passive unit is functional. If it isn't, you can quickly pass traffic back without getting stuck waiting for the box to reload or worse actually having a hardware issue. If you test things in a controlled environment you can limit any possible downtime.