topic Re: Force HA failover - how? in General Topics

Force HA failover - how?

darren_g — Mon, 10 Feb 2014 21:40:31 GMT

This is probably simple, but the documentation I can find is unclear, so I'm going to ask anyway. Better to ask and seem a fool than to act and remove all doubt!

I have a pair of PA's in HA configuration. Owing to an issue on the inside with internal switching, I need to be able to kick from the current "active" to the current "passive" to test something, and then back again.

So far, the only way I've found to do this is to reboot the "active" - not really palatable if something goes wrong, because they're only 2020's, and take 15 minutes to boot up to operational state.

Is there any way I can force the "passive" to go active without rebooting?

Thanks

Re: Forde HA failover - how?

jvalentine — Mon, 10 Feb 2014 21:43:42 GMT

On your primary/active firewall, go to the GUI, Device / High Availability / Operational Commands / Suspend local device.

Re: Force HA failover - how?

darren_g — Mon, 10 Feb 2014 21:56:22 GMT

Does that cause a failover, or just suspend the HA configuration? This is what I am a little concerned about - I don't want both devices going active.

Also, how do you re-enable it? Just do the same on the other device?

Re: Force HA failover - how?

jvalentine — Mon, 10 Feb 2014 22:09:58 GMT

This will cause your primary device to suspend, which will cause your secondary device to come active.

Once you've suspended it, then the "suspend" link will change to "resume" (or something like that).

Re: Force HA failover - how?

darren_g — Mon, 10 Feb 2014 22:31:35 GMT

Cool, thanks!

Re: Force HA failover - how?

FredReimer — Tue, 11 Feb 2014 01:38:20 GMT

Hello Darren,

Just an addition piece of information:

If you have configured "Link and Path monitoring" into the HA config, You can unplug one of the monitoring interface from Primary node and it will trigger a failover to another node.

Thanks

Re: Force HA failover - how?

holmesw — Tue, 11 Feb 2014 14:37:00 GMT

The CLI commands for forcing failover and then returning to HA mode are:

admin@pafw2(active)> request high-availability state suspend

Successfully changed HA state to suspended

admin@pafw2(suspended)> request high-availability state functional

admin@pafw2(passive)

Re: Force HA failover - how?

darren_g — Thu, 13 Feb 2014 01:43:14 GMT

FredReimer wrote:

Hello Darren,

Just an addition piece of information:

If you have configured "Link and Path monitoring" into the HA config, You can unplug one of the monitoring interface from Primary node and it will trigger a failover to another node.

Thanks

Not so easy when the firewall is in a data centre 15 minutes walk from where I sit in my office. 🙂

Re: Force HA failover - how?

darren_g — Thu, 13 Feb 2014 01:44:29 GMT

holmesw wrote:

The CLI commands for forcing failover and then returning to HA mode are:

admin@pafw2(active)> request high-availability state suspend
Successfully changed HA state to suspended
admin@pafw2(suspended)> request high-availability state functional
admin@pafw2(passive)

I knew about the suspend command, I just wasn't sure if it meant suspend the HA state, or suspend the HA (and make both firewalls active).

I know now it's the former - and I've tested it this week, so I know it works. Makes troubleshooting the network issues way easier when I can just put the primary back online with two clicks!

Cheers and thanks