HA pair App and Threat sync to peer question.

TranceforLife — Fri, 02 Jun 2017 14:59:38 GMT

Hi All,

Apps and threats on the currently active box are set to download and install, on the passive to download only. Active box received and installed new updates. Will that automatically be synced to the passive? If we have a revert scenario where the Passive device has its apps and threats configuration to download and install, but the Active to download only. What will happen and what is the best practice to configure these setting on the both firewalls?

Thx,

Myky

Re: HA pair App and Threat sync to passive question.

reaper — Thu, 01 Jun 2017 11:11:20 GMT

well there's 2 strategies:

- you can have the active member download, install and sync to peer, this will download and install, then copy the file over to passive and install there too (or you can download and sync, which will download and copy but not install)

with this setting the secondary device does not really need a schedule ince the primary will perform that task

- or you can have each member do their own schedule and not use the sync option but that could lead to mismatch if one has install and the other has download only

There is a revert option available in the dynamic updates themselves which i would recommend to prevent running into the mismatch:

If your main concern is that a bad content package would be installed and you need a fallback, i would look into using the 'threshold' function first

This will check for the release date/time of a content package and adds x time (as configured in the threshold) before checking the update server again. if the same file is still available it will go ahead and install, if a newer update is available (emergency content release or content package retracted) the instll will be aborted and the threshold is reset if a new package is available. after the second threshold a last check is done and if the package is still available, the emergency package is installed. if yet another version is see, the install will be abortted altogether and wait until the next scheduled event (watch out for AV updates as these can have several valid releases in a day where content is usually updated once to twice a week)

on top of the above, there's still the manual revert

hope this helps!

Re: HA pair App and Threat sync to passive question.

TranceforLife — Thu, 01 Jun 2017 11:43:53 GMT

Thank you for taking the time to reply and yes, it does help a lot. I don't have any further questions yet 😉

topic Re: HA pair App and Threat sync to passive question. in General Topics

HA pair App and Threat sync to peer question.

Re: HA pair App and Threat sync to passive question.

Re: HA pair App and Threat sync to passive question.