VIP rule stops replying to arp' ing

[#1]

Has anyone seen a condition where a firewall rule stops working with a Virtual IP (VIP) because ARP replies fail? More specifically, I have Port1->Port5 rules using a Virtual IP address tcp forwarder. For one of our IP addresses, the Fortigate 300A HA A-A cluster fails to respond to ARP requests. Other IP' s are fine. The config has been relatively static. Running " diagnose sniffer packet port1 ' arp' " reveals that the interface where the VIP should be listening sees the ARP requests. It does not respond. We' re on FortiOS 2.80 build 393. This doesn' t seem to be a config issue. I have a bunch of other VIP rules that are nearly identical that are working fine. This seems like a bug. I' ve tried disabling the rules and re-enabling. I have also deleted them and re-created them. I have not tried to restart the Fortigate cluster. I' ve seen little in the logs to give me much information on why this has failed. Uptime: 49 days 7+ hours

[UkWizard]

Have you tried it with just firewall running ? as it might be the cluster thats causing the problem. try a sniff on both boxes at the same time, then do the arp test. Are you sure that the IP isnt being used somewhere else on the external network ? In case there is a device claiming it already. If you have a spare IP in your range, try changing the config to use that and see if it responds okay.

[#3]

Have you tried it with just firewall running ?

This is not an IP address assigned to the Interface so I have to use a Virtual IP address for this. I' m not sure if I follow the intent of your question.

as it might be the cluster thats causing the problem. try a sniff on both boxes at the same time, then do the arp test.

I guess that I would have do the manage ha thing from a SSH CLI session to packet sniff on both guys? I' ll give it a go.

Are you sure that the IP isnt being used somewhere else on the external network ? In case there is a device claiming it already. If you have a spare IP in your range, try changing the config to use that and see if it responds okay.

That' s an option I can test. This is puzzling.

[UkWizard]

Have you tried it with just firewall running ?

Sorry, typo, meant to say; Have you tried it with just ONE firewall running ?

[#5]

I checked out UkWizard' s website and found the troubleshooting area for Virtual IP' s. One thing suggested was trying enabling NAT. It made no difference which I could detect. I ended up shuttding down the nearly inactive node. That did not correct it. I brought that one back up. Then I rebooted the most active node node. That seemed to cause traffic to flow again, albeit it is a workaround and not a problem solution. Thanks. -Jim p.s. -- Even though I' m active-active, I don' t have the CLI command enabled that load balances TCP connections across the cluster.