Gilles;
Thanks for your reply! We haven't changed anything as I know. We had problem with UDP packets before. When backend servers tried connect to outside DNS servers through udp 53, we saw packet drop. We rerouted DNS traffic bypass CSS.
This time backend email servers initiate connection to external authentication server through udp 989. This application works for year until Monday. The external server is on public network 128.143.2.x subnet The backend servers are on private network 192.168.1.x subnet. Backend servers' default gateway point to CSS. Sniffing at external servers, we saw udp989 traffic from backend nodes through private ip 192.168.1.x. We have source group configured for outbound traffic. I am including some of our example configuration.
Our CSS run at 7.40.2.02. I am thinking upgrade to 8.20.2.01
!************************** SERVICE **************************
service guppy
ip address 192.168.1.x
redundant-index 211
keepalive type none
active
service neon
ip address 192.168.1.x
redundant-index 210
keepalive type none
active
service tetra
ip address 192.168.1.x
redundant-index 212
keepalive type none
active
!*************************** GROUP ***************************
group tetra
add service tetra
vip address 128.143.2.x
redundant-index 242
active
group neon
add service neon
vip address 128.143.2.x
redundant-index 240
active
group guppy
vip address 128.143.2.x
redundant-index 241
add service guppy
active
Haiying
