Some Virtual Systems are Down after rebooting a VSX cluster member with enabled Identity Awareness Blade

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk102067
Technical Level
Product	VSX, Identity Awareness, Quantum Appliances, Quantum Scalable Chassis
Version	R75.40VS (EOL), R76 (EOL), R76SP.10_VSLS (EOL), R76SP.30 (EOL), R77 (EOL)
OS	Gaia, Crossbeam XOS
Platform / Model	2000, 4000, 12000 VSX (EOL), 21000 VSX (EOL), Crossbeam (EOL), IP1280 (EOL), IP2450 (EOL), Intel/PC, Power-1 (EOL), UTM-1 (EOL), VSX-1 (EOL), 61000, 41000
Date Created	15-Aug-2014
Last Modified	30-Apr-2018

Symptoms

After rebooting a VSX cluster member with enabled Identity Awareness Blade, output of 'cphaprob state' command shows that some Virtual Systems are in state 'Down'.
Output of 'cphaprob list' command on problematic VSX cluster member shows that Device 'Synchronization' reports its state as 'problem'.

Debug of FWD process during the boot of the VSX cluster member shows that it is not able to connect to the peer member to perform Full Sync because of a missing SIC:

fwsyncn_connect:  server IP_ADDRESS_OF_PEER_MEMBER alive 1 
fwsyncn_get_server_sic_name: Cannot get member's object from database 
fwsyncn_connect : got server_sic_name = NULL 
fwsyncn_connect: trying to connect to IP_ADDRESS_OF_PEER_MEMBER 
fwclient_do_connect_e: server IP_ADDRESS_OF_PEER_MEMBER port 256 sicname N/A 
fwclient_do_connect_e: hostname IP_ADDRESS_OF_PEER_MEMBER hostsicname N/A addr HEX_IP_ADDRESS_OF_PEER_MEMBER
fwclient_do_connect_e: addr IP_ADDRESS_OF_PEER_MEMBER
fwclient_do_connect_ei: sic name for server ... is NULL. 
peers addresses are 
... ... ...
sic_client_do_connect: no server sic name supplied, server sic name is unknown.

Cause

The rebooted VSX cluster member fails to find SIC rule in order to communicate with the peer member and fails to run the Full Sync.

This specific issue is caused by ADLOG (Identity Logging).

Solution

Note: To view this solution you need to Sign In .