Passive appliance in HA is in Faulty State

Hi Ankur,

Thank you for reaching out to Sophos Community.

Would you be so kind as to share the case ID related to this issue? Thank you 

06051687. We re imaged the secondary node but that did not restore the services so we ended up restarted the primary node as well after which the services came back online. However after about 5 hours we received notification of the secondary node going into Fault State but it looks like it recovered and is back into Auxiliary mode. What's unclear is if the secondary node is in Fault state why and how does it take all the services of the Primary node down/Dead? 

Hello Ankur,

Thank you for the Case ID; it seems you’ll have another session with an L2 on Friday; after today's session, some steps have been provided to you to be performed today after hours.

We’ll keep monitoring the Case.

Regards,

Hello Ankur,

Thank you for the Case ID; it seems you’ll have another session with an L2 on Friday; after today's session, some steps have been provided to you to be performed today after hours.

We’ll keep monitoring the Case.

Regards,

I received response from Sophos Global Escalation Specialist according to whom the DNS servers reachable behind the XFRM interface are responsible for the crash and asked us to switch to public DNS servers not reachable over XFRM interface. 2 things to note here

1. DNS servers behind XFRM interfaces causing the crash in our case is not valid as we have same devices in other location configured with same DNS servers behind XFRM interface and they are not showing this behaviour

2. Using Public DNS serves will result in name resolution failures for internal devices who rely on internal DNS servers for names  resolution.

The solution provided indicated the issue with Sophos firewall basic functionality. If what Sophos says DNS server behind xfrm interface is the root cause of the issue then the device cannot be configured or connected to any other location via route based VPN service as XFRM interface is automatically created when route based VPN is configured and having a local DNS server will result in device crashes.

Also when the device goes into fault state why and how does it take all the services of the Primary node down eventually? This behavior is unclear to us and neither has Sophos being able to diagnose this problem.

Hello Ankur,

Thank you for the update.

Checking in the NC that the GES engineer assigned (NC-108226) it seems an RCA has been requested. As your case seems to match these symptoms. 

I have left a note in the case about your comments.

Regards,