Secure Client connecting to backup firewall - what am I missing?

[tvaldes]

I have 2 Nokia IP 330s running NGX R60 on IPSO 3.9

They are set up clustered and seem to work well for normal traffic.

The issue I'm having is when I connect using Secure Client.

Sometimes when I connect the VPN, x.x.x.1 and access the VIP via https, I connect to the backup firewall (x.x.x.3). If I view the VRRP Monitor screen, it shows me that all the interfaces are Backups. When I connect this way, I am unable to access any of my machines.

This doesn't always happen.. Sometimes when I connect and then access the VIPs https interface (x.x.x.1), I am connected to the primary (x.x.x.2).. VRRP Monitor shows that the firewall's interfaces are all Masters... When I connect this way, every thing works fine.

Any idea what I'm missing? I can give you any more information you may need..

thanks,
tom

[chillyjim]

You should only be connecting to the VIP. The standby gateway will most likely not process the traffic.

[tvaldes]

My Secure Remote client is set to connect to the VIP x.x.x.1.. However when I check out the voyager web page of x.x.x.1, the title of the page is FW2 (which is by backup firewall) instead of the master which is FW1.

[tvaldes]

More info:

I'm wondering if it could have something to do with my Var partition running low and eventually out of space.

My Var partition was at around 98% and then filled up.

I deleted my old logs files and now have plenty of space.

Any idea if this is just a coincidence or the cause?

thanks.

[chillyjim]

In a word yes.

[tvaldes]

Well the issue is still happening so clearing space wasn't the fix.

Anyone have any ideas?

thanks.

[melipla]

Originally Posted by tvaldes

Well the issue is still happening so clearing space wasn't the fix.

Anyone have any ideas?

thanks.

I'm trusting that you cpstop & cpstarted the cluster members after freeing up disk space?

Otherwise I'd try looking at smartview tracker, filter on control messages and see why the cluster failed over (you'll need to know when it failed over). You can run "cphaprob -a if" from the command line which may tell you why.

Good luck.