HA Secondary Unit in SafeMode binds the Shared HA Virtual IP, causing Duplicate IP Conflicts, MAC Flapping, and traffic blackholing.
Description
In a High Availability (HA) Active/Standby deployment, one appliance may enter SafeMode following a failed firmware upgrade, boot failure, boot loop, or manual recovery operation. This can occur in both controlled scenarios and uncontrolled scenarios.
Under normal circumstances, a firewall operating in SafeMode should only be reachable through its dedicated monitoring IP address and recovery IP address. However, we have identified an issue where the appliance may incorrectly assume ownership of the shared HA Virtual IP (VIP) while operating in SafeMode.
Affected Products:
SonicWall Gen 7 firewalls
SonicWall Gen 8 firewalls
NSv Series virtual firewalls
Affected deployments:
High Availability (firewall in non HA environments are not affected).
Resolution
This issue was reported and reproduced in our labs. Engineering analysis and debugging have confirmed that the SafeMode unit is offering the HA shared/virtual IP while operating in recovery mode, leading to the duplicate IP scenario.
The issue is currently under investigation by the Engineering team.
Internal Reference: GEN7-59493
Action Plan:
To prevent potential network disruption, if any firewall unit enters SafeMode.
1.- Immediately isolate the affected appliance from the production network.
2.- Access and recover the unit using either the dedicated MGMT port, a direct point-to-point connection to X0 on 192.168.168.x, or via the Serial Console.