Overview

When configuring High Availability (HA) in Kerio Control with multiple WAN links in failover mode, you may experience an issue where the WAN link role flags (Primary and Backup) disappear from the Slave appliance after completing the HA setup. This issue can manifest with the following symptoms:

• Primary and Backup flags are cleared on the Slave appliance after HA synchronization completes
• Communication errors appear on the Slave appliance when WAN links change state to UP during failover
• Manually setting the WAN flags on the Slave appliance works temporarily, but the flags are lost again after the Master appliance comes back online and another HA switch occurs

This behavior has been observed in Kerio Control version 9.6 build 9147 when using HA with multiple WAN interfaces configured in failover mode.

Solution

This issue has been resolved in Kerio Control version 9.6 build 9161 and later. The fix ensures that WAN Primary/Backup flags are correctly retained during HA configuration synchronization and role switches.

Step 1: Verify Current Build Version

1. Log in to the Kerio Control administration interface on your Master device
2. Go to the Dashboard and note the Kerio Control version/build
3. Optional (recommended): Go to Status > System Health > Support Information and download the Support Information file to confirm the Kerio Control version/build date
4. If you are running build 9147, proceed with the upgrade steps below

Step 2: Back Up Current Configuration

Step 3: Upgrade to Build 9161 or Later

1. Obtain build 9161 (or later) from the Kerio Downloads portal
2. Proceed with Upgrading Kerio Control using the designated HA procedure:

   1. Upgrade Master appliance.

   2. Upgrade Slave appliance.

   3. Allow some time for the HA synchronization.

Step 4: Verify WAN Failover Configuration

1. After both devices are upgraded, log in to the Master device administration interface
2. Go to Interfaces
3. Confirm the Internet connectivity mode is set to Multiple Internet Links - Failover
4. Verify that the WAN links are set as primary and secondary (backup). If you need to reconfigure this, click More Actions > Configure in Wizard and select Two Internet links with failover, then select the primary and secondary interfaces.
5. Click Apply (if shown) to save changes
6. Wait for the HA sync to propagate the changes to the Slave.

Step 5: Test Failover Behavior

1. Log in to both Master and Slave device administration interfaces to monitor behavior
2. Simulate a failover by powering off or disconnecting the Master device
3. Verify that:
   • The Slave device correctly raises the WAN interfaces
   • WAN Primary/Backup flags remain intact on the Slave device
   • No communication errors appear in the logs
4. Power on the Master device and allow it to rejoin the HA cluster
5. Verify that the WAN flags are still correctly configured on both devices after the Master returns to active state

Still seeing the issue after upgrading?

If the WAN Primary/Backup flags are still being cleared after upgrading both appliances to a fixed build, contact Support and include the following:

• Support Information file from both the Master and Slave appliances (Status > System Health > Support Information)
• Debug logs from both appliances with the High Availability option enabled
• Screenshots from both appliances showing:
  • Interfaces (WAN interfaces and their Primary/Backup roles)
  • High Availability tab (current status/health check)

Summary

The issue where WAN Primary/Backup flags are lost in High Availability setups with multiple WAN links in failover mode has been resolved in Kerio Control version 9.6 build 9161 and later. To resolve this issue, upgrade both your Master and Slave devices to build 9161 or later, back up your configuration before upgrading, ensure both devices run the same firmware version, and verify that WAN failover flags are retained after HA synchronization and failover events.

FAQ

Q1: What causes the WAN Primary/Backup flags to disappear in HA configurations?

A1: This is a product defect in Kerio Control version 9.6 build 9147 where the HA synchronization mechanism can overwrite the failover configuration on the Slave appliance when multiple WAN links are configured. The issue has been fixed in build 9161 and later versions.