Customer is facing an issue where the resynchronize with network jobs for all the SRX300 firewalls managed by Security Director Cloud take about 2-4 minutes to complete.
When a resynchronize with network job is run for a firewall from SDC, SDC sends multiple RPC requests to the SRX firewall and waits for their response. Once SDC receives the response for all the RPC requests from the firewall, then SDC collates the information and marks the job as complete.
The time taken for the resynchronize with network job to complete depends on 3 major things.
The time taken for SDC to send the RPC requests to the SRX firewall as well as the time taken for SDC to display the information in the SDC GUI depends on the bandwidth of the link between SDC server and SRX firewall. You can use the MTR command to verify the time taken to reach the SDC Cloud servers.
To measure the time taken for SRX firewall to respond to the RPC requests from SDC, you can login to the SRX firewall and enter the shell mode and check the /var/log/messages file. When SDC sends a RPC request to the SRX firewall, the below logs are printed in the messages file.
2.2.2.2 : SDC Cloud server IP-Address
1.1.1.1 : Management IP-address of SRX Firewall
Nov 21 14:11:50 srx4600 mgd[61659]: UI_AUTH_EVENT: Authenticated user 'sduser' assigned to class 'j-super-user'
Nov 21 14:11:50 srx4600 mgd[61659]: UI_LOGIN_EVENT: User 'sduser' login, class 'j-super-user' [61659], ssh-connection '2.2.2.2 7804 1.1.1.1 63971', client-mode 'cli'
Nov 21 14:11:50 srx4600 mgd[61659]: UI_CMDLINE_READ_LINE: User 'sduser', command 'xml-mode netconf need-trailer '
Nov 21 14:11:50 srx4600 mgd[61659]: UI_LOGOUT_EVENT: User 'sduser' logout
The resynchronize with network job starts with the above logs and ends with the below log.
Nov 21 14:12:29 srx4600 mgd[64227]: UI_AUTH_EVENT: Authenticated user 'sduser' assigned to class 'j-super-user'
Nov 21 14:12:29 srx4600 mgd[64227]: UI_LOGIN_EVENT: User 'sduser' login, class 'j-super-user' [64227], ssh-connection '2.2.2.2 7804 1.1.1.1 62950', client-mode 'netconf'
Nov 21 14:12:29 srx4600 mgd[64227]: UI_NETCONF_MONITORING_ADD: Netconf session with pid '64227', parent pid '62956' is being added
Nov 21 14:12:29 srx4600 mgd[64230]: UI_YANG_GENERATION: Yang generation is successful
Nov 21 14:12:29 srx4600 mgd[64227]: UI_NETCONF_CMD: User 'sduser' used NETCONF client to run command 'get-pki-ca-certificate level=detail'
Nov 21 14:12:30 srx4600 mgd[64227]: UI_NETCONF_MONITORING_DELETE: Netconf session with pid '64227' is being deleted
Nov 21 14:12:30 srx4600 mgd[64227]: UI_LOGOUT_EVENT: User 'sduser' logout
As you can see in the above logs, the first RPC request was received at 14:11:59 and the last RPC request was received and completed at 14:12:29 and thus the device took a total of 13 seconds.
When we check the same in the SRX300 firewalls, the total time taken by SRX firewall to complete all the RPC requests is approximately between 1.5 minutes - 4 minutes. This causes the resynchronize with network job to take more time to complete.