DHCP WAN not working after HA failover?

That is confusing.   As far as I know, the DHCP protocol allows for a lease to be renewed at any time.   The expectation is that the client will attempt to renew the lease at about 50% of the maximum lease period.   If the MAC is unchanged, the renewal should be a non-event.  Even more, if the DHCP lease information is replicated properly, and the MAC is unchanged, then the newly-active device would not need to ask for a lease.   I have no idea why the lease would need to expire before things start working.

Overall, if this is for a business, it sounds like the best option is to switch to a static address.  If this is for home use, HA may not reduce enough downtime to make it worth this frustration, other than for its educational value.

It might be informative to put a PC with Wireshark on the switch that implements the HA connection, and monitor traffic during the HA failover.   It would give you valuable information for pursuing a support case with Sophos.  You raise some interesting questions that would benefit from more data.

Yeah, this is truly mystifying.  This is a residential FIOS connection, so DHCP is the only option.  I am running the UTM CE, so I don't know if I can open support tickets or not.  Based on balfson's rulz 7.7 apparently fixing this, it seems almost like UTM is taking the slave down and bringing it back up, and trying to send the DHCPREQUEST before the link is ready, resulting in an error.  It isn't as simple as just dropping the DHCPREQUEST, as I would expect retries - when this failure mode occurs, the dhclient process is terminating and you are stuck.  This would seem to be confirmed by the fact that clicking the renew button 'fixes' the problem (as that would start the dhclient process.)  It's also odd that this only seems to happen when failing back to the preferred node.

I‘m seeing the exact same issue at some of my customers‘s Networks.

After a Failover the new Master is using the same IP and Virtual MAC but there is no Connection (Error in Webadmin). After i renew the IP on the Interface (same IP) the connection is immediately online again.

In Switzerland there are many FTTH Provider that deliver a fixed IP in DHCP Mode (but just always the same IP). So we have to use DHCP WAN even if it is a „fixed“ IP.

I do not always see this Problem but i think that this phenomen exists since many months, maybe years.

I will try the suggestion to fix the Interface to 1000/Full, even if on the other side (HP Procurve) i can only select 1000/Auto (i think that‘s because of some RFC in Gigabit Ethernet).

I think that this Problem is not ISP related because how should the ISP block or even notice the Failover if the MAC (Virtual) stays the same? I also do not think that there is a DHCP Release at Failover, isn‘t it? So the ISP should not notice anything about this.

I‘m curious about other replys and expiriences.

- Michael

Unfortunately it has not worked, i had the same Issue again even though i had configered the WAN Interface for 1000/full. After shortly disconnect the Cable of the WAN interface (just 1-2 seconds) the connection was back.

There is no DHCPREQUEST or something in the Logfile, so the UTM seems to think the Internet is all good...

Does it only happen on failback like in my case?

No, respectively, i made an Upgrade of the Firmware (the Firewalls were online some Days at this configuration), and after the updated Slave was online an took over (master still at the old firmware) the Connection to the Internet was lost.

Well, damn.  I *thought* forcing the speed to 100/full worked, but no.  Just applied most recent firmware.  Master failed over to slave, and... WAN offline until I hit 'renew'.  This is really a showstopper for me.  I don't *need* HA really - I wanted it in case of failure or so I could apply updates with no downtime, but if I have to sit here and click 'renew', that's not at all helpful :(

What does Sophos Support say about this?

Cheers - Bob

I haven't contacted them.  I'm running the free license version, so I assume I'm SOL?

Scanning back over this thread and noticing that you have a preferred master reminded me that I don't trust that functionality.  How about if you just leave that off and perform a manual failback with ha_daemon -c takeover at the command line - does that give the desired result?

Cheers - Bob