QQ - On a stateful A/P palo alto firewall would you expect session reliability to be able to reconnect to existing HDX sessions after the Firewall failover has occured (It dropped during failover and session reliability kicks in but it timed out without reconnecting HDX sessions even though the passive firewall took over). I have no issues with Netscaler HA failover with session reliability
r
Ryan Gallier
08/22/2024, 6:04 PM
That's the entire point of SR, because Netscaler is not stateful HA.
Ryan Gallier
08/22/2024, 6:04 PM
hmmm, sorry, i misread your question... Your Palo's SHOULD be stateful HA, and shouldn't kick out the sessions in the first place.
c
c4rm0
08/22/2024, 6:12 PM
Yeah it's a stateful firewall when the firewall was failed over the HDX connection dropped "connection interrupted " so looked like session reliability was about to kick in but it timed out after 5 mins and didn't re-establish the session. I think it may be because the cloud connectors go out the firewall and would of lost connection to Citrix cloud so would be transitioning to LHC mode
r
Ryan Gallier
08/22/2024, 6:13 PM
oof, yeah, i've not done that with CCs..
c
c4rm0
08/22/2024, 6:14 PM
I may set the forcedoutagemode LHC reg key on the cloud connectors next time before the firewall Failover to rule that out.