This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Failover / high availability question

Hi Everyone,

I was wondering if someone could shed some light on an issue I am having with my UTM.

The situation is as follows:

UTM 9.2 (latest version) on esxi 5.5 update 1, managed through vsphere.

3 network interfaces (VMXNET3) - broken down as follows:
1 management (192.168.1.100) - on vswitch0 using vmnic 4
1 lan (192.168.1.224) - on vswitch1 - using vmnic0
1 WAN - on vswitch 2 - using vmnic2

(Each interface has its own physical nic in the switch group)

All the vswitches are separated in vsphere and are not connected to each other.

I am new to virtual networks, but my understanding is that if i pull out the cable for the lan port (192.168.1.224), i should not be able to ping it. However, when i do that, after a few ping timeouts, the connection is restablished.

Looking at the arp tables shows me that the traffic to the lan port (192.168.1.224) is now going through the management connection (vmnic4). I can also still ping the management connection using its assigned IP (192.168.1.100)

From my undertsanding of virtual networks, this should not be happening, correct? To me, its like pulling out the lan connection on a physical switch, and unless there is failover, i should not be seeing this behaviour?

I believe I have checked all the places on the utm to see if HA or failover is enabled - maybe I missed something somewhere. I have also disabled the HA checkmark on the advanced options of the interfaces.

I dont believe its esx that is causing an issue, as i have a windows 7 test vm setup in the same manner (the same 3 connections and the same 3 port groups) and traffic stops as expected.

Are there any options in the UTM that I am missing that may be causing this behaviour?

Maybe something I am missing in esx?

Any insights or thoughts as to why this is happening would be greatly appreciated. And thanks for taking the time to read this long post.

Thanks!

This thread was automatically locked due to age.

0 BAlfson over 11 years ago

It looks like you have overlapping subnets with vmnic4 and vmnic0.

If fixing that doesn't solve your problem, please explain what you mean when you speak of failover and HA.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 KLee over 11 years ago in reply to BAlfson

Thanks for the insight Bob.

Sorry for the late reply, but I've been playing around with the network and busy with my day job. 8)

Using the tip you provided, I finally understood why the packets were acting the way they were.

I have attached a diagram showing what I wanted to accomplish. I did it this way because I wanted to have two separate networks, one for production and one for management, and I thought that having two separate interfaces would allow me to accomplish that via one network subnet.

Originally, I thought the issue may have been HA / failover related because the connection would go down for a short while when I removed the "red" connection in the diagram, but then the packets would then start flowing through the light blue interface.

But apparently, as you mentioned, I think it was because the packets were "confused" as to which interface to use on the Management PC since the destination was on the same subnet.

I ended up solving the issue with (learning about and) using a VLAN, where I dedicate one VLAN to management and one for production. This also allowed me to only use one interface and leave the second for another network to use, as my NIC supports multiple VLANs (Intel NICs seem to be great feature set wise).

Not sure if this response was just as confusing as my question, but I just thought that I should follow up and thank you for the help. 8)

I do have another question, but I will start another thread for it, as it's not related.
- UTM_Layout.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel

Failover / high availability question

Submitted a Tech Support Case lately from the Support Portal?