Config: 2 * Cat 6513 (hybrid OS) 7.6(10) / 12.1(22)E5 + 2 * FWM 2.2(1). 1 * FWM per 6513 chassis. FWM in multiple context and failover mode. The state and failover replication is performed over two seperate VLANs / Gb ether channel links between the 6513s.
Issue: On failover, the standby unit becomes active and some connections survive. However, some connections do not survive for which there is an xlate entry. Need to "clear xlate global a.b.c.d" to force the connection to be re-established and then the connection works again. Applies to more than one protocol ie ICMP, TCP etc.
"show failover" on the standby unit shows "Stateful Failover Logical Update Statistics" with receive errors for "Xlate_Timeout", "TCP NPs" and "UDP NPs" (other counters are clean) of about 90%, 0.5% and 26% respectively. The counters are increasing slowly. The TCP and UDP NPs error counts are identical and increment together. The Xlate_Timeout error counter increments independently.
Questions:
Why do I need to clear xlate? Surely I shouldn't need to do this? The fact I need to clear the xlate implies the xlate got to the standby unit... but maybe it is an old entry that shouldn't be there because the active / standby replication has failed in some way?
If the LU receive errors indicate that the xlates are not being replicated from active to standby unit, does the FWM sort this out by resending or is the update lost and does that explain my different xlate count on the active / standby units?
If I do a "show xlate" on the active and standby units they have a different number of xlates in their tables. Shouldn't these get replicated between the firewalls? Why are the numbers different?
If these are bugs that you have seen before, do you know the Cisco bugID?
Thanks, Dave.
