Event ID: 5120 Event ID: 5142. Cluster shared volume has entered a paused.

Hi Guys.
A few days ago our production cluster CRASHED completely, 300 VMs went crazy. It affected more than 2k people. I spent 8 hours on the phone with Microsoft and they couldn’t fix.

Cluster Shared Volume 'Volume6' (') is no longer accessible from this cluster node because of error '(1460)'. Please troubleshoot this node's connectivity to the storage device and network connectivity.
Cluster Shared Volume 'Volume6' () has entered a paused state because of 'STATUS_BAD_NETWORK_PATH(c00000be)'. All I/O will temporarily be queued until a path to the volume is reestablished.

After, some time I found that SMB traffic is getting blocked. I asked our networking team if they did any changes on routers, switches, the answer was no.

 This indicates a problem with the underlying network or transport, such as with TCP/IP, and not with SMB. A firewall that blocks TCP port 445, or TCP port 5445 when using an iWARP RDMA adapter, can also cause this issue.

I decided to disabled Windows Firewall and restart VMMS service. Which fixed the issue. Later I found on the internet that ” We later discovered this problem to be related to a known issue with IP Sec offload being enabled when the firewall is also enabled. Disable IP Sec Offload “
I hope that this helped you guys. Have a good one.