We have 2 SA 6500 devices (version 7.3R7) are configured in an active/passive cluster. When users logging into the extrenal interface's VIP, user's connection shoule be in the active node, but we see some of user's connections appear in the passive node.
Has anyone seen this behavior, know what typically causes it, and how to work around it?
Thank you for all your assistance.
So the passive node also can provide the service. My perception is wrong.
I will try to rebuild the active/passive cluster and re-check my configuration.
Was there any failover attempt? It is possible these sessions were not successfully transferred when the VIP was failed over. The other possibility is end user are accessing the device directly via the external and internal port. Passive node can still service users regardless if it owns the VIP or not.