topic Dynamic update sych in HA environment in General Topics

Dynamic update sych in HA environment

ChanceMaggard — Mon, 17 Jan 2011 21:03:49 GMT

We have a pair of 4050s in a HA configuration. I was wondering if there was anyone that has a best practice or advice on setting up the Dynamic update synch. We are looking for the best way to keep the environment up to date through dynamic update while in normal operation and when failed over to the secondary.

With the primary FW dynamic update is set to synch with peer, what is the best configuration schedule for the secondary FW?

If the Secondary is set up to update after the first and is also set to update dynamically and synch will it cause unnecessary downloads or pushes?

I am concerned with just having the primary as the only update source for the secondary. If the cluster was to fail over to the secondary, it would not update automatically without a configuration change.

Thanks for your help!

Re: Dynamic update sych in HA environment

asapcomsupport — Tue, 18 Jan 2011 09:05:33 GMT

I´m also interested in this. Is there a best practice or how to for that?

Re: Dynamic update sych in HA environment

jalbrecht — Wed, 02 Feb 2011 18:52:40 GMT

I have the exact same question and concern around what exactly happens if both are checked to replicate to the other. Also, while the updates happen, what is the impact to traffic, if any. Is it safe to run these updates during the day, with active connections?

Re: Dynamic update sych in HA environment

bpappas — Wed, 02 Feb 2011 20:15:21 GMT

Sync-to-peer is intended for use when the HA secondary has no path to the internet from the management interface. In this scenario the secondary will need to have the primary push the dynamic updates to it. (remember that your secondary may have no active interfaces on the dataplane in the passive mode).

If both units have the ability to access the PA update servers from their management interface we suggest that you stagger the download and install times and not use the sync-to-peer feature. This way you have the opportunity to failover to the passive unit if there is a problem on the primary during the update or as a result of a problem that arises after the update. When you stagger the download-and-install times we suggest that you leave at least 30 minutes between HA pair members to allow the update to download and install before the process begins on the peer.

-Benjamin