About Gareth-Doyle

NOTE:  This appears to have been an issue in the Cloud space. I suspect a VMotion or reboot of the VM Host resolved the problem as an unrelated issue with spinning up access to the VM was resolved at the same time this HA issue was resolved and no configuration changes were made. -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------------------------- Hey, all. I'm setting up a pair of VM-500's in a cloud environment and having some issues with the HA between them.  HA1 is Red HA1 Backup is Green HA2 is Green HA1 Backup is configured to use the Management port on both VM's, HA2 is configured to use an IP in an isolated subnet separate from all other traffic. HA1 is also set in an isolated subnet, separate from all other traffic, but remains down. I have confirmed that the peer IPs are correct.   In the CLI when I look at the HA1 interface I see the following:   Firewall 1 (currently passive):     admin@oci-sbx-vcn1-fw1(passive)> show interface all total configured hardware interfaces: 6 name id speed/duplex/state mac address -------------------------------------------------------------------------------- ethernet1/1 16 ukn/ukn/down(power-down) 02:00:17:07:12:80 ethernet1/2 17 ukn/ukn/down(power-down) 02:00:17:0b:c2:fa ethernet1/3 18 ukn/ukn/down(power-down) 02:00:17:10:67:aa ethernet1/4 19 ukn/ukn/down(power-down) 02:00:17:01:74:e3 ethernet1/5 20 10000/full/up 02:00:17:16:3f:fc ethernet1/6 21 10000/full/up 02:00:17:10:94:66 ---- OMITTED OUTPUT ---- ethernet1/5 20 1 ha 0 10.11.11.162/29 ethernet1/6 21 1 ha 0 10.10.10.186/29 ---------------------------------------------------------------- admin@oci-sbx-vcn1-fw1(passive)> show interface ethernet1/5 ----------------------------------------------- Name: ethernet1/5, ID: 20 Link status: Runtime link speed/duplex/state: 10000/full/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 02:00:17:16:3f:fc Operation mode: ha Untagged sub-interface support: no ----------------------------------------------- Name: ethernet1/5, ID: 20 Operation mode: ha HA interface role: ha1, function: control-link Interface IP address: 10.11.11.162/29 Interface management profile: N/A Service configured: Zone: N/A, virtual system: vsys1 Adjust TCP MSS: no Policing: no ----------------------------------------------- ----------------------------------------------- Physical port counters read from MAC: ----------------------------------------------- rx-broadcast 0 rx-bytes 2912 rx-multicast 0 rx-unicast 52 tx-broadcast 0 tx-bytes 99180 tx-multicast 0 tx-unicast 1653 ----------------------------------------------- ----------------------------------------------- Detailed physical port counters read from MAC: ----------------------------------------------- No detailed counters found ----------------------------------------------- Hardware interface counters read from CPU: ----------------------------------------------- bytes received 2912 bytes transmitted 92568 packets received 52 packets transmitted 1653 receive incoming errors 0 receive discarded 0 receive errors 0 packets dropped 0 ----------------------------------------------- Logical interface counters read from CPU: ----------------------------------------------- bytes received 2912 bytes transmitted 92568 packets received 52 packets transmitted 1653 receive errors 0 packets dropped 0 packets dropped by flow state check 0 forwarding errors 0 no route 0 arp not found 0 neighbor not found 0 neighbor info pending 0 mac not found 0 packets routed to different zone 0 land attacks 0 ping-of-death attacks 0 teardrop attacks 0 ip spoof attacks 0 mac spoof attacks 0 ICMP fragment 0 layer2 encapsulated packets 0 layer2 decapsulated packets 0 tcp cps 0 udp cps 0 sctp cps 0 other cps 0 -----------------------------------------------       Firewall 2 (currently active):     admin@oci-sbx-vcn1-fw2(active)> show interface all total configured hardware interfaces: 6 name id speed/duplex/state mac address -------------------------------------------------------------------------------- ethernet1/1 16 10000/full/up 02:00:17:13:ac:48 ethernet1/2 17 10000/full/up 02:00:17:01:8a:f0 ethernet1/3 18 10000/full/up 02:00:17:10:fc:9b ethernet1/4 19 10000/full/up 02:00:17:04:59:33 ethernet1/5 20 10000/full/up 00:00:17:01:2c:88 ethernet1/6 21 10000/full/up 02:00:17:16:d2:6d ---- OUTPUT OMITTED ---- ethernet1/5 20 1 ha 0 10.11.11.163/29 ethernet1/6 21 1 ha 0 10.10.10.187/29 ---------------------------------------------- admin@oci-sbx-vcn1-fw2(active)> show interface ethernet1/5 ----------------------------------------------- Name: ethernet1/5, ID: 20 Link status: Runtime link speed/duplex/state: 10000/full/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00:00:17:01:2c:88 Operation mode: ha Untagged sub-interface support: no ----------------------------------------------- Name: ethernet1/5, ID: 20 Operation mode: ha HA interface role: ha1, function: control-link Interface IP address: 10.11.11.163/29 Interface management profile: N/A Service configured: Zone: N/A, virtual system: vsys1 Adjust TCP MSS: no Policing: no ----------------------------------------------- ----------------------------------------------- Physical port counters read from MAC: ----------------------------------------------- rx-broadcast 0 rx-bytes 3864 rx-multicast 0 rx-unicast 69 tx-broadcast 0 tx-bytes 81420 tx-multicast 0 tx-unicast 1357 ----------------------------------------------- ----------------------------------------------- Detailed physical port counters read from MAC: ----------------------------------------------- No detailed counters found ----------------------------------------------- Hardware interface counters read from CPU: ----------------------------------------------- bytes received 3864 bytes transmitted 76216 packets received 69 packets transmitted 1361 receive incoming errors 0 receive discarded 0 receive errors 0 packets dropped 0 ----------------------------------------------- Logical interface counters read from CPU: ----------------------------------------------- bytes received 3864 bytes transmitted 76216 packets received 69 packets transmitted 1361 receive errors 0 packets dropped 0 packets dropped by flow state check 0 forwarding errors 0 no route 0 arp not found 0 neighbor not found 0 neighbor info pending 0 mac not found 0 packets routed to different zone 0 land attacks 0 ping-of-death attacks 0 teardrop attacks 0 ip spoof attacks 0 mac spoof attacks 0 ICMP fragment 0 layer2 encapsulated packets 0 layer2 decapsulated packets 0 tcp cps 0 udp cps 0 sctp cps 0 other cps 0 -----------------------------------------------     ... View more

We are setting up a Windows365 environment that, obviously, lives in Azure cloud. These machines are access by RDPing into them. Due to some access management controls and the systems not actually living on our network, the Windows365 machines were having issues connecting properly. One of the engineers on the project got an idea to install GlobalProtect on these machines and connect to our network via VPN, which worked for him after installing the proper certs, etc... However, he noticed that when he reboots the machine, he is on longer able to RDP into the machine. The only way he is able to get back into the machine is to restore it to a previous state prior to the GlobalProtect installation. He did some testing and noted that after installing GlobalProtect, if he sets the service to start manually, he is able to reboot the machine and then RDP into it, start the GlobalProtect service, and then connect to the VPN.   - Has anyone had any experience with Windows365 and GlobalProtect similar to this issue? - Does anyone have any ideas on what may be causing the issue, and perhaps, how to correct it?   Definitely a difficult issue as no logs can be pulled due to the machine restoration being needed to even get into the machine.   Thanks! ... View more