Meraki MX warm spare failover: Sticky ICMP flows

[Frank-NL]

Hi,

We are seeing some strange behaviour, when doing a failover (and failback) with our MX85 (MX18.211.5.2). It happens specifically with ICMP flows, and only resolves when we reboot both MX'es to clear all flows.

We are seeing this when we do a failover MX active -> standby, and also when we failover WAN1 -> WAN2.

Certain running icmp ping flows just start being dropped and will not be routed anymore, until we reboot both MX's in the same time.

Anybody else experiencing similar issues? I will be reporting to support as well.

Kind regards, Frank

[rhbirkelund]

When you do the failover from the active to standby, is the active also the Primary MX?

What are you pinging, and from what?

What setting do you have on the WAN Failover and Failback?

The graceful settings behaves in such a way that when a failover occurs, and flows going out WAN1 will not failover to WAN2 immediately, and fall back to WAN1, once that connection is restored. It will only failback to WAN1 once a new flow is begun. 

I'm wondering if this may be what you are seeing.

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failo...

[Frank-NL]

Thank you, it is configured as immediate. Also with any other protocol we see the flows failing over/back as expected. It is just ICMP. 

We started an ICMP ping from a random client towards:

- Internet IP endpoint

- Remote AutoVPN endpoint

When we do a failover from the primary (active) towards the backup, all other flows immediately continue but the ICMP ping no longer gets routed.

Second test is we removed WAN1 connection, for failover towards WAN2, and same behaviour is seen.

[PhilipDAth]

You should also consider upgrading to 18.211.6.

[Frank-NL]

Yes we will try this, I corrected the post there was a typo, we are running now:

MX18.211.5.2

[Brash]

As @rhbirkelund mentioned, check which failback behaviour is configured.

As a side note, if your network is assigned to a template, you won't see the explicit and dropdown to change and it will be hard set to graceful.

[Frank-NL]

Good to know, thank you. THe network is configured to immediate and not part of a template. Notice that other protocols have no sticky flows