Skip to main content
James_G
New Member
September 7, 2020
Question

UDP based vserver not failing over unless clear sessions

  • September 7, 2020
  • 0 replies
  • 1495 views

Hi, having an issue with a UDP based vserver not failing over unless clear sessions.

 

In the below config I have a vserver listening on UDP port 4500 then forwarding to 2 real servers with a ping health check. If I shutdown one of the real servers, the ping health check correctly marks the endpoint as down, but existing sessions still try and connect to the failed server. if I run diagnose sys session clear (with relevant filters) the next session correctly hits the alive real server. My issue is obviously I can't be running a clear session every time we need a fail over.

 

below is the vserver and the fw policy in use. Never had this issue with TCP sessions, so think this is a problem unique to UDP. Anyone with relevant advice?

 

edit "VS-AOVPN-Virgin-port4500" set uuid dc76fac0-ec36-51ea-2bba-84b893b25849 set type server-load-balance set extip xx.xx.xx.xx set extintf "port3" set server-type udp set monitor "Ping" set extport 4500 config realservers edit 1 set ip 192.168.1.61 set port 4500 next edit 2 set ip 192.168.1.62 set port 4500 next end next

 

edit 466 set name "AOVPN-in-Virgin" set uuid 7349a416-ec37-51ea-9e36-4550de7f2474 set srcintf "port3" set dstintf "LegacyDMZ" set srcaddr "all" set dstaddr "VS-AOVPN-Virgin-port4500" set action accept set schedule "always" set service "IKE" set inspection-mode proxy set logtraffic all next

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!