This message was deleted.

what does show ha node via cli say ? they both set to enabled and set to participate in HA ? synchronization and propagation both enabled ?

Yes synchronization and propagation are enabled. Looks ok to me:

show ha node

1) Node ID: 0 IP: 192.168.254.232 (NsDevDc01) Node State: STAYPRIMARY Master State: Primary Fail-Safe Mode: ON INC State: DISABLED Sync State: ENABLED Propagation: ENABLED Enabled Interfaces : 0/1 1/1 1/2 1/3 Disabled Interfaces : None HA MON ON Interfaces : None HA HEARTBEAT OFF Interfaces : None Interfaces on which heartbeats are not seen : None Interfaces causing Partial Failure: None SSL Card Status: NOT PRESENT Sync Status Strict Mode: DISABLED Hello Interval: 200 msecs Dead Interval: 3 secs Node in this Master State for: 0212:23 (dayshrsmin:sec) 2) Node ID: 1 IP: 192.168.254.233 Node State: STAYSECONDARY Master State: Secondary Fail-Safe Mode: ON INC State: DISABLED Sync State: FAILED (Unable to connect to primary, please check the netwo rk connectivity from secondary to primary) Propagation: ENABLED Enabled Interfaces : 0/1 1/1 1/2 1/3 Disabled Interfaces : None HA MON ON Interfaces : None HA HEARTBEAT OFF Interfaces : None Interfaces on which heartbeats are not seen : None Interfaces causing Partial Failure: None SSL Card Status: NOT PRESENT

Looks related to SSL settings bound to internal services. These services should have the ns_default_ssl profile.. attached. Maybe a packet trace will show anything related to SSL handshake.

SSL_connect failed for 192.168.254.232:3008: error:1408F10B:SSL

Ok thanks, I'll try to check some traces. Maybe I'm also going to open a support case.

Can you SSH into the appliances?

Would assume it's the same issues as here even if it's another firmware version https://support.citrix.com/article/CTX286560 Also why didn't you upgrade to 13.0-71.44 which contains the fix for DTLS amplifcation attack?

Do you have a firewall between the two NSIPs?

he still has one node set to stay primary and the other node set as staysecondary after the firmware upgrade run set ha node -hastatus enabled on each node to re enable HA

stayprimary/staysecondary shouldn't affect HA sync or propagation, but if there's a version difference between the two nodes then that would cause sync/prop to be disabled

yeh its normally disabled by default when there is a version mis match

just making sure - newer firmwares will enable secure RPC automatically so if those ports aren't open between NSIPs you'll have a bad time

I've seen this a few times now after upgrades - have a look at the SSL profiles for front end and back end communication, and make sure there are common settings they can use to talk to each other. The SSL default back end profile on the primary will be used to talk to the SSL default front end profile on the secondary

Hi, i just had that issue while upgrading a customer this morning to newest v13 though. I fixed it by enabled TLS 1.1 and 1.2 on the nsrpcs-127.0.0.1-3008 internal service, since they were not using the ssl profile

Sorry for my late reply. I just disabled secure RPC on both nodes and HA synchronization seems to work again. Now I'm trying to figure out if there is something wrong with the SSL profiles. FYI: there's no Firewall between nodes.

Take a screenshot of the service name I posted above. Guessing the issue is the same as I had my customer Saturday. The service wasn’t using the ssl profile and only had sslv3 and tls 1.p enabled on the services, enable 1.2 and see if it works secure. If it doesn’t work still it might be the cipher group bound.

Mads is right, have a look at the individual service mentioned above if you are not using SSL profiles. If you are using profiles, make sure your default back end profile is set to use a set of matching protocols and ciphers as whatever profile is assigned to the internal service, otherwise the back end profile of the primary node will not be able to communicate with the front end profile on the nsrpcs service.

@Mads Petersen Yes you were right. The internal service nsrpcs-127.0.0.1-3008 didn't have TLS1.1 and 1.2 enabled. After enabeling it, HA synch seems to work again with secure RPC enabled.

Was the same issue i ran into saturday when i updated a customer. I'm talking with the PMs about it, because it seems to me that Citrix expects something is configured (TLS 1.2 is enabled or using SSL profiles) but doesn't verify it, and since they are forcing secure with the upgrade, it breaks.

Great, thanks for your help.

No problem at all.

FYI: Just talked to Citrix support since we already had an open case with them. They just confirmed that you need to enable TLS 1.2 for the internal service (TLS1.1 shouldn't be needed) From the latest versions 13.0-64.35, TLS1.0,TLS1.1 is deprecated. Hence HA communication fails if TLS1.2 is disabled. Earlier HA communication was working on TLS 1.0 and TLS 1.1. Now the TLS 1.0 and 1.1 is deprecated, so HA communication will fails if TLS1.2 is disabled. By default the TLS 1.2 is disabled on the firmware version, hence we need to enable it for the HA communication from now onward. There's also an internal KB which should be published soon.

@Dennis Parker I know you made a thread, but the solution is most likely what we posted in here. Make sure TLS 1.2 is enabled on the internal service.

Oh, cool. Don't remember reading this, but that is great to see. Thanks for this.

No problem. I also mentioned in the post on the discussion board that you linked.

Saw that ... right before I replied with this. 🙂