Second failover failure with conntrackd - INVALID packets

[Yoann Juet <yoann.juet@univ-nantes.fr>]

Hi,

I have a testbed cluster with two firewall nodes and conntrack sync. 
Initially, node1 is the primary and node2 the backup.

1) I open a jabber connection. node1 replicates the conntrack session to 
node2 (conntrackd in synchronization mode FT-FW).
2) First failover : node2 becomes the new primary, node1 the backup. 
node2 recovers the TCP session. Everything seems to work fine at this 
moment.
3) Second failover : just 1 to 2 minutes after the first failove, node1 
becomes the primary, node2 the backup. The jabber TCP session is still 
into the conntrack table but the session is broken. I see many packets 
denied due to the INVALID state.

"nf_ct_tcp: ACK is over the upper bound (ACKed data not seen yet) IN= 
OUT=xxxxxx"

The TCP window tracking rejects packets after the second failober. I 
just have to activate "nf_conntrack_tcp_be_liberal" to make it work 
again, but that's not, for me, a good solution:

echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal

Why conntrackd cannot recover the TCP session in the second failover ? 
Is it a known issue, possibly due to a misconfiguration ? I'm using 
debian/lenny (kernel 2.6.26-1-amd64) with heartbeat2, conntrack 0.9.6 
and a shell script that executes :

** on the new primary :
                conntrackd -c -C /etc/conntrackd.conf
                conntrackd -f -C /etc/conntrackd.conf
                conntrackd -R -C /etc/conntrackd.conf

** on the new backup :
                conntrackd -n -C /etc/conntrackd.conf

Thanks for your help,
Regards,