topic Re: Why the User-ID Agent status of passive device on HA mode shows not-conn:idle? in General Topics

Why the User-ID Agent status of passive device on HA mode shows not-conn:idle?

willstech — Tue, 02 Apr 2013 06:13:03 GMT

Hello there.

I have a question related to a User-ID Agent.

My PA-5050 is configured with HA mode (Active-Passive).

Couple of devices are connected User-ID Agent.

There are user agent connection status on the both of devices.

Active Device

Name Host Port Vsys State Ver Usage

---------------------------------------------------------------------------

AD 10.40.29.64 5007 vsys1 conn:Get IPs 5

Passive Device

Name Host Port Vsys State Ver Usage

---------------------------------------------------------------------------

AD 10.40.29.64 5007 vsys1 not-conn:idle 0

my question is why the Passive Device Status is not-conn:idle?

is it normal status as a passive device on the HA mode??

Please let me know if someone who know of it.

Thanks,

Eugene.

Message was edited by: Yujin Won

Re: Why the User-ID Agent status of passive device on HA mode shows not-conn:idle?

mikand — Tue, 02 Apr 2013 11:39:03 GMT

Is the userid-service on the PA box using a dataplane interface or the management interface to reach the 10.40.29.64 box?

Because when using active/passive the passive unit dataplane is basically disabled (regarding forwarding) until the unit becomes active. Which gives that only the physical management interface is the only interface which is always active no matter if the unit is in active or passive state.

Re: Why the User-ID Agent status of passive device on HA mode shows not-conn:idle?

willstech — Wed, 03 Apr 2013 06:35:38 GMT

The both active and passive devices are only using a management Interface to communicate with the User-ID Agent (10.40.29.64).

The both devices are configured with V-wire mode.

I can access the passive device web UI through management interface.

Therefore, Management interface on the Passive device is working well.

But User-ID Agent connection state on the passive device shows the not-conn:idle.

Re: Why the User-ID Agent status of passive device on HA mode shows not-conn:idle?

TheSquire — Wed, 03 Apr 2013 08:11:14 GMT

This is expected behaviour as only the primary device will be used for user-id, then all the mappings will sync to the passive device

You can verify this by setting the current primary to suspend to force a failover, at which point you should see the new primary connect to the user agent.