After an activity of migration to IRBs, we noticed SSH was not working on primary node, only back up node. SSH to cluster fxp0 does not work either.

• SSH to primary node fxp0 does not work.
• SSH to cluster fxp0 does not work.
• SSH to backup node fxp0 works.
• Session is created and it appears in a show security flow session, but there is no return traffic.
• Ping does not show return traffic either.
• Flow traceoptions does not show the return traffic packet filters, but besides that, everything looks ok.
• When we try to start the ping from the fxp0, it says there is no route.

This happens because the SSH request was in-band, so it has to be routed out through a reth interface. However, there is no static route for the fxp0. So, fxp0 does not know how to route the responses from SSH and ICMP requests.

After creating a static route pointing to the management subnet IP and using the respective reth IP as the next hop, traffic started working. So, fxp0 would use the static route to the reth interface, and reth knows how to reach the management host.

However, the reason why it was still working on the backup node is because both nodes had the backup router configuration. This feature works as a static route for management traffic in the backup node (because the backup node does not have RPD running). But it only works on the RG0 secondary node, not on the primary. The backup router route was the same as the one we configured, pointing to the reth IP as the next hop.

So, in this scenario, you would need a fxp0 backup router and static route for both nodes because one works for the primary and the other for the secondary, and the roles might change anytime, so you need both configurations on both nodes.