UTM Block Communication - Only HA Failover can fix it

Hi Sophos Community,

I am probably a newbie with UTM but also our UTM consulting could not help us. Maybe you can point me in the right direction.

We have two Sophos UTM SG230 with failover configured. Since a couple of months we have the following issue:

- If a Windows server (VM or physical) boots and UTM block the communication. No ping to the UTM, no routing between VLANs, no Internet.

- The only solution is to trigger a manual failover. After that everything works fine.

My thougts and test until now:

-UTM block my IP or MAC, searched different logs, could not find anything. Thought about an option to grep IP/MAC in all logs, files etc. But no clue if that is possible

- When I do the failover maybe the ARP cache will be cleared. Something network related? I already removed our spanning tree. Sadly with no success.

Do you have any idea what could cause a behavior like this or what I should direct my focus to?

Regards

David