Disconnects on system changes

[jbakers24_]

I have been getting reports of random disconnects over the SSL VPN from users lately. The setup is a pair of clustered 4500s in active/passive with virtual systems on 6.5R2. The device averages about 150 users a day with minimal CPU usage. I have been able to correlate the reported network drops to times when I am making system changes like adding routes/vlans or things like changing a DNS server IP address in a virtual system. A couple of times while adding routes, the cluster actually failed over. One time when this happened the cluster tried to fail over, but the active member wouldnt release the VIP ip address and the fail over got stuck in limbo, disconnecting all nework connect sessions, untill i failed it back. I am not seeing anything in the logs when the disconnects happen, I have worked with Juniper to try and resolve the issue, but they are useless. It only seems to happen to specific users as well, not all users are effecting, only a few random users and always the same random users. They can work fine for a day and then the next day I am doing work and get disconnected left and right. I am planning to upgrade to 6.5R8 Next weekend if you think that would help.

[Vijesh Bhat_]

Hi,

I believe you must go with what is recommended by JTAC. i.e v7.0r4
There many limitations associated with 6.5 builds.

[jbakers24_]

that hardly seems like an acceptable solution or answer. Users should not be getting disconnected when I make changes to the SA device, i can directly correlate users getting intteruptions of service with a change made to the SA device, even changes that are not effecting any sort of connection attemps. Modyfying a UI has done it. We are certain this is when the disconnects are happening. A user will be fine all day, we make a change and within a miniute or two i get a report that they temporarily lost there connection.

[Vijesh Bhat_]

Hi,

Not all changes in the config shall result in disconnection.
There are a few config changes which restarts service or which makes a module unavailable and there is a small blip in the connection. i.e changing Static Routes, uploading Citrix Installation file etc.

[DanTulovsky_]

Is this something you can reproduce on demand?