Changing certain MX settings causes the SDWAN to drop

[SimonReach]

HI everyone, got an SDWAN configured across all of our sites running Meraki kit and all running at least 18.107.2, including the site with an issue.

We have 2 MX84s, 1 configured as primary and 1 as the hot spare.  If we make a change to the DHCP settings on the MX, the connection to the internet stays up but the SDWAN will drop for about 10 seconds every time.

Anyone seen this before?

[KarstenI · Accepted solution]

This is from the release notes:

Known issues

• After making some configuration changes on MX84 appliances, a brief period of packet loss may occur. This will affect all MX84 appliances on all MX firmware versions

[SimonReach]

Thank you, i do see that the latest 18.107.5 firmware still has the issue so will hold fire on updating to that version just yet.

[KarstenI]

I don't expect to see this issue removed anytime soon. It's an issue for too long already. Either it is very hard to fix or based on the platform unfixable.

[Ryan_Miles]

It's hardware based and AFAIK will never change

[Mloraditch]

Would be nice if they updated the note to be clear about that. I and others suspected as much for quite a while, maybe even document what changes make it happen

[Bram1985]

Based on what? The 17.x firmware series did not have this issue.

[Ryan_Miles]

It was present in 17.x. And 16.x. And everything before it. Every version of release notes mentions.

[JGill]

Was a lot faster to converge in the v17 release.   We see FW rules change fast, its just the Site to Site Tunnels that need to reconverge.    So outbound internet traffic and local traffic are not really impacted, but we see a 5-10 second hit on tunnels converging.  Think 4-7 pings that drop any time you make a change.     Will test on our MX85's and MX95's to see what their times look like.  Been meaning to look at that for awhile, just hasn't floated to the top of the list 🙂

[JGill]

Also for visibility,  additive FW rules are immediate.  If you have a FW rule where your are taking away or blocking access, you need to roll the Primary MX.  State / rule change is immediate, spare takes over and processes.  Still have the VPN tunnel / session delay.