Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 14 replies
  • Subscribers 6 subscribers
  • Views 3643 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM HA Cluster Node wechselt in nicht bestimmbaren Intervallen auf "DEAD"

Julian Schreiner

Guten Tag liebes Sophos Forum,

ich habe momentan ein Problem mit zwei verschiedenen HA-Clustern.

Der erste HA-Cluster ändert den Status in unregelmäßigen, nicht wirklich bestimmbaren Abständen auf "DEAD" (Firmware: 9.703-3, Sophos SG115). Der Cluster läuft mehrere Wochen ohne Probleme bis irgendwann ein Node "DEAD" ist.

Der zweite HA-Cluster ändert den Status eines Nodes nach einem Firmware-Update auf "DEAD" (Firmware: 9.705-3, Sophos SG115).

Die Logs besagen das der Node kein bzw. ein stark "wackelnden" Link und keine IP-Adresse erhält und aufgrund eines Timeouts dann als "DEAD" gekennzeichnet wurde. Weder die Neuinstallation der UTM, noch das rekonfigurieren des Cluster half das Problem zu lösen. Gibt es evtl. jemanden der das Problem ebenfalls hatte und dieses lösen konnte oder hat jemand noch eine Idee um das Problem zu lösen?

Folgend noch ein Logauszug:

020:10:24-10:11:27 sophos-***_daemon[4179]: id="38A3" severity="debug" sys="System" sub="ha" seq="M:  197 27.497" name="Netlink: Lost link beat on eth3!"
2020:10:24-10:11:39 sophos-***_daemon[4179]: id="38A3" severity="debug" sys="System" sub="ha" seq="M:  198 39.230" name="Netlink: Found link beat on eth3 again!"
2020:10:24-10:11:40 sophos-***_daemon[4179]: id="38C1" severity="error" sys="System" sub="ha" seq="M:  199 40.266" name="up2date: Node 2 is dead, received no heart beats"
2020:10:24-10:11:40 sophos-***_daemon[4179]: id="38A0" severity="info" sys="System" sub="ha" seq="M:  200 40.266" name="Executing (wait) /usr/local/bin/confd-setha mode master master_ip 198.19.250.1 slave_ip ''"
2020:10:24-10:11:40 sophos-***_daemon[4179]: id="38A0" severity="info" sys="System" sub="ha" seq="M:  201 40.547" name="Executing (nowait) /etc/init.d/ha_mode topology_changed"

Vielen Dank für die Mithilfe.

Mit freundlichen Grüßen,

Julian Schreiner



This thread was automatically locked due to age.
  • 0

    Hallo Julian,

    sind die beiden SGs denn am "HA"-Anschluss direkt miteinander mittels LAN-Kabel verbunden?

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0

    Hello Julian,

    Thank you for contacting the Sophos Community!

    Most likely there is a switch between the UTMs which might be blocking at some point the heartbeat, if this is the case please connect the UTMs directly using the designated HA port.

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to PhilippRusch

    Guten Morgen Philipp,

    ja, die beiden SGs hängen direkt am HA Port zusammen, ohne Dritt-Gerät (Switch). Ergänzend wurde mir mittgeteilt, dass die Sophos UTM die dann als "DEAD" markiert wurde einmal testweise als "Haupt-UTM" ins Netzwerk gehängt wurde. (Die 2. Sophos UTM die nicht als "DEAD" markiet war - Also der Master wurde natürlich abgeklemmt). Daraufhin wurde von der Sophos in etwa 10 Sekunden Abschnitten gemeldet das die Verbindung zum WAN verloren geht.

    Mit freundlichen Grüßen,

    Julian Schreiner

  • 0 in reply to Julian Schreiner

    Genau das darf man nicht tun: "testweise" HA umklemmen und dann wieder anklemmen.

    Danach kann man HA komplett zurücksetzen und muss neu anfangen.

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to PhilippRusch

    Hallo Philipp,

    ich habe wie oben genannt momentan 2 Fälle dieser Art, einen Fall kann ich nun erstmal ausnehmen, da hier noch ein Switch zwischen dem HA besteht, der erstmal entfernt werden muss.

    Beim 2. Fall (wo dieser Test durchgeführt wurde) ist mir noch nicht ganz schlüssig, ob er nach dem Status "Active - Dead" durchgeführt wurde oder danach. Das müsste ich erstmal erfragen.

    Mit freundlichen Grüßen,

    Julian Schreiner

  • 0 in reply to emmosophos

    Hello Emmanuel,

    in one of the two cases, there is a switch between the UTMs. In the other case the UTMs are directly connected.

    In the case, where the UTMs are directly connected, the problem is happening when a new Firmware is installed. After the installation, the log entries as posted in the topic are displayed.

    Regards,

    Julian Schreiner

  • 0 in reply to Julian Schreiner

    Hello Julian,

    Thank you for the follow-up!

    At the time of the issue is there anything on the following logs:

    system.log, fallback.log kernel.log 

    regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
  • 0 in reply to emmosophos

    Hello Emmanuel,

    this are the entries found in the logs at the time the second Node goes "DEAD" (Remember, the HA Cluster crashed after Firmware Updates).

    Regards,

    Julian Schreiner

    System:

    2020:10:24-10:11:08 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:12 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0

    2020:10:24-10:11:12 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:27 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down

    2020:10:24-10:11:27 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:42 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0

    2020:10:24-10:11:42 sophos-ma-1 [daemon:info] nwd[6491]:  Waiting for MDW cycle to end

    2020:10:24-10:11:50 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0

    2020:10:24-10:11:50 sophos-ma-1 [daemon:info] admin-reporter[12255]:  [INFO-005] Successful WebAdmin login

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Reloading Config

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3

    2020:10:24-10:11:53 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0

    2020:10:24-10:11:53 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down

    2020:10:24-10:12:02 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0

    2020:10:24-10:12:02 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up

    Kernel:

    2020:10:24-10:11:20 sophos-ma-1 kernel: [ 1367.866946] net_ratelimit: 3 callbacks suppressed
    2020:10:24-10:11:20 sophos-ma-1 kernel: [ 1367.866955] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:20 sophos-ma-1 kernel: [ 1367.866960] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:21 sophos-ma-1 kernel: [ 1368.867619] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:21 sophos-ma-1 kernel: [ 1368.867633] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:24 sophos-ma-1 kernel: [ 1371.489815] igb 0000:01:00.0 eth3: igb: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
    2020:10:24-10:11:25 sophos-ma-1 kernel: [ 1372.389260] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:25 sophos-ma-1 kernel: [ 1372.389273] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:26 sophos-ma-1 kernel: [ 1373.386819] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:26 sophos-ma-1 kernel: [ 1373.386834] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:26 sophos-ma-1 kernel: [ 1373.590752] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:26 sophos-ma-1 kernel: [ 1373.590762] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:27 sophos-ma-1 kernel: [ 1374.387557] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:27 sophos-ma-1 kernel: [ 1374.387571] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:27 sophos-ma-1 kernel: [ 1374.587710] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:27 sophos-ma-1 kernel: [ 1374.587720] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:27 sophos-ma-1 kernel: [ 1374.859487] igb 0000:01:00.0 eth3: igb: eth3 NIC Link is Down
    2020:10:24-10:11:28 sophos-ma-1 kernel: [ 1375.588376] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:28 sophos-ma-1 kernel: [ 1375.588389] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:29 sophos-ma-1 kernel: [ 1376.607859] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:29 sophos-ma-1 kernel: [ 1376.607872] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:30 sophos-ma-1 kernel: [ 1377.605815] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:30 sophos-ma-1 kernel: [ 1377.605830] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:31 sophos-ma-1 kernel: [ 1378.393166] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:31 sophos-ma-1 kernel: [ 1378.393180] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:31 sophos-ma-1 kernel: [ 1378.606501] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:31 sophos-ma-1 kernel: [ 1378.606514] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:32 sophos-ma-1 kernel: [ 1379.391083] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:32 sophos-ma-1 kernel: [ 1379.391091] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:32 sophos-ma-1 kernel: [ 1379.622383] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:32 sophos-ma-1 kernel: [ 1379.622397] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:33 sophos-ma-1 kernel: [ 1380.391817] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:33 sophos-ma-1 kernel: [ 1380.391826] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:33 sophos-ma-1 kernel: [ 1380.619969] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:33 sophos-ma-1 kernel: [ 1380.619981] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:34 sophos-ma-1 kernel: [ 1381.620631] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:34 sophos-ma-1 kernel: [ 1381.620644] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:36 sophos-ma-1 kernel: [ 1383.515485] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:36 sophos-ma-1 kernel: [ 1383.515498] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:36 sophos-ma-1 kernel: [ 1383.630762] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:36 sophos-ma-1 kernel: [ 1383.630772] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.509073] IPv4: martian source 172.16.0.123 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.509086] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.514673] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.514678] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.630766] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.630777] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.882488] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:37 sophos-ma-1 kernel: [ 1384.882500] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.515379] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.515391] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.631464] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.631473] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.879643] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:38 sophos-ma-1 kernel: [ 1385.879656] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:39 sophos-ma-1 kernel: [ 1386.523830] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:39 sophos-ma-1 kernel: [ 1386.523850] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:39 sophos-ma-1 kernel: [ 1386.600074] igb 0000:01:00.0 eth3: igb: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
    2020:10:24-10:11:39 sophos-ma-1 kernel: [ 1386.880350] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:39 sophos-ma-1 kernel: [ 1386.880363] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.431493] cluster: http service has no effect (ha_daemon)
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.887423] net_ratelimit: 4 callbacks suppressed
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.887432] IPv4: martian source 192.168.3.94 from 192.168.3.1, on dev eth0
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.887437] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.897805] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:41 sophos-ma-1 kernel: [ 1388.897814] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:42 sophos-ma-1 kernel: [ 1389.626310] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:42 sophos-ma-1 kernel: [ 1389.626320] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:42 sophos-ma-1 kernel: [ 1389.657588] igb 0000:01:00.0 eth3: igb: eth3 NIC Link is Down
    2020:10:24-10:11:42 sophos-ma-1 kernel: [ 1389.898523] IPv4: martian source 172.16.0.155 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:42 sophos-ma-1 kernel: [ 1389.898533] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:43 sophos-ma-1 kernel: [ 1390.527023] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:43 sophos-ma-1 kernel: [ 1390.527033] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:43 sophos-ma-1 kernel: [ 1390.627039] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:43 sophos-ma-1 kernel: [ 1390.627049] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:44 sophos-ma-1 kernel: [ 1391.527663] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:44 sophos-ma-1 kernel: [ 1391.527673] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:44 sophos-ma-1 kernel: [ 1391.649178] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:44 sophos-ma-1 kernel: [ 1391.649189] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:45 sophos-ma-1 kernel: [ 1392.528346] IPv4: martian source 172.16.0.100 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:45 sophos-ma-1 kernel: [ 1392.528360] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:45 sophos-ma-1 kernel: [ 1392.648421] IPv4: martian source 172.16.0.122 from 172.16.0.1, on dev eth0.101
    2020:10:24-10:11:45 sophos-ma-1 kernel: [ 1392.648430] ll header: 00000000: ff ff ff ff ff ff 00 1a 8c f0 01 a0 08 06        ..............
    2020:10:24-10:11:47 sophos-ma-1 kernel: [ 1394.421687] net_ratelimit: 2 callbacks suppressed

    Fallback:

    2020:10:24-10:11:08 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:12 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0
    2020:10:24-10:11:12 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:24 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:27 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down
    2020:10:24-10:11:27 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:39 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:42 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0
    2020:10:24-10:11:42 sophos-ma-1 [daemon:info] nwd[6491]:  Waiting for MDW cycle to end
    2020:10:24-10:11:50 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0
    2020:10:24-10:11:50 sophos-ma-1 [daemon:info] admin-reporter[12255]:  [INFO-005] Successful WebAdmin login
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Reloading Config
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:52 sophos-ma-1 [daemon:info] nwd[6491]:  attempting to write route: itf=eth1; name=eth3
    2020:10:24-10:11:53 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up> group 0
    2020:10:24-10:11:53 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up but link is down
    2020:10:24-10:12:02 sophos-ma-1 [daemon:info] irqd[5717]:  eth3 ether 7c:5a:1c:69:fa:77 <broadcast,multicast,up,running,lowerup> group 0
    2020:10:24-10:12:02 sophos-ma-1 [daemon:info] nwd[6491]:  Interface eth3 is up and link is back up

  • 0 in reply to Julian Schreiner

    Hallo Julian,

    das sieht so aus, als ob du zwei Schnittstellen im selben Netzwerk (-Switch / VLAN) eingesteckt hast.

    Das mag die Firewall gar nicht.

    Mit freundlichem Gruß, best regards from Germany,

    Philipp Rusch

    New Vision GmbH, Germany
    Sophos Silver-Partner

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Julian Schreiner

    Hello Julian,

    Thank for the logs, how are the cables connected in the switches? Are you connecting two interfaces into the same switch?

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
Unfiltered HTML