CSS 11503 stops forwarding traffic

[douhanm]

Hello

We are seing some really strange issues with our 11503, after x hours in production it stops forwarding traffic comin into one VIP and all services are down to 0 connections, during this time I can reach each server directly by addressing them with their own IP so the servers are live. the CSS tells me the services are alive. and everything is active.

we have 2 owners and 8 services, and this only happens to 1 owner and 4 services in that owner, the other one always works. a restart of the CSS fixes the problem for another x hours. Any ideas would be greatly appreciated

[Gilles Dufour]

what version ?

Could you capture a couple of show tech when the problem occurs [make sure you sent some traffic to the vip between the 2 occurences of the show tech].

see if the upstream router as an arp entry for the vip.

Gilles.

[douhanm]

we are running ver 07.50.1.03

I will check the upstream device ( a PIX in this case ) to see the ARP entries when it fails. What is the command to see the MC of a CSS interface?

Also we have another CSS and SCA that previously used the same addresses that we moved to this new CSS, on the old CSS we did suspend on the VIP and the SCA we did not touch.

After we moved we cleared all ARP caches but do you think even though we did suspend on the old CSS's VIP it could somehow respond to ARP requests? or could it be the SCA that previously also returned decrypted HTTPS to the same address that could cause problems?

and since a restart always fixes the problem it seems me to be either ARP related or some sort of bug but if it was a bug I would expect it to be well known so I am leaning against some sort of ARP issue, it is just a matter of finding where.

I am also putting sniffers before and after the CSS to see what is going on during failures.

rgds

Matt

[Gilles Dufour]

you can see the css mac address by doing 'ip if' in llama/debug mode.

Gilles

[douhanm]

that shows me teh MAC of physical interface but we are using redundant VIP's, how can I see the MAC for the redundant VIP ?