Description

After a manual MNHA failover was executed to make node0 ACTIVE and node1 BACKUP, node0 became ACTIVE and node1 became BACKUP; however, the expected MNHA re-sync did not occur.

Symptoms

The control plane state of Node 1 SRG1 is not ready.

Solution

When a manual failover of MNHA occurs, the expected MNHA re-sync does not happen, causing the SRG1 Control Plane State to be in NOT READY. This issue occurs when the ICL is down, and IKED is waiting in the BACKUP WAIT state until the ICL is restored.


In the backup wait state, IKED checks the mirror connection status and sync status provided by pub-sub; if either is down, IKED becomes stuck in the backup wait state.

 

A temporary workaround is to reboot node1, which transitions the IKED state from backup-wait to backup, sets the Control Plane State to READY, and re-syncs MNHA.

user@router> show security ike statistics ha-fsm | no-more
+--------------------------------+--------------------------------+
| HA FSM module stats (SRG-ID 1) | State             |
+--------------------------------+--------------------------------+
|timestamp           :Jan 05 01:50:32.34523     |
|event             :JsrpdMastershipChng      |
|previous_state         :Backup             |
|current_state         :ActiveTransition        |
|duration in cur-state     :5223 microsecond        |
+--------------------------------+--------------------------------+
|timestamp           :Jan 05 01:50:32.39746     |
|event             :SyncReset           |
|previous_state         :ActiveTransition        |
|current_state         :ActiveFinalResync       |
|duration in cur-state     :94 microsecond         |
+--------------------------------+--------------------------------+
|timestamp           :Jan 05 01:50:32.39840     |
|event             :IkedResyncDone         |
|previous_state         :ActiveFinalResync       |
|current_state         :Active             |
|duration in cur-state     :32:12:55:27          |
+--------------------------------+--------------------------------+
|timestamp           :Feb 06 14:45:59.333359     |
|event             :JsrpdMastershipChng      |
|previous_state         :Active             |
|current_state         :ExitWait            |
|duration in cur-state     :0:00:00:15           |
+--------------------------------+--------------------------------+
|timestamp           :Feb 06 14:46:14.350735     |
|event             :IkedCleanupDone        |
|previous_state         :ExitWait            |
|current_state         :Init              |
|duration in cur-state     :57 microsecond         |
+--------------------------------+--------------------------------+
|timestamp           :Feb 06 14:46:14.350792     |
|event             :IkedInitDone          |
|previous_state         :Init              |
|current_state         :BkupWait            | >>>> IKED is stuck in backup-wait
|duration in cur-state     :0:20:13:40           |
+--------------------------------+--------------------------------+
 

This issue is fixed in the following releases: junos:22.4R3-S6, junos:23.4R2-S4, junos:24.2R2, junos:24.4R1, and junos:25.1R1.
 

Modification History

2025-02-24 : Article Created