topic Re: push the commit on one member of the cluster only? in General Topics

push the commit on one member of the cluster only?

pmartyn — Wed, 30 Aug 2017 16:52:50 GMT

Hello,

To test the link monitoring of the high-availability, i want to shut one interface on the active member.
I set up the interface at down but i do not find how to do the commit on the active member only.
Is there a solution to push the commit on one member of the cluster only?

Thanks for your help.

Re: push the commit on one member of the cluster only?

BPry — Wed, 30 Aug 2017 18:04:19 GMT

@pmartyn,

Within your High Availablility settings under setup there is an option to toggle Config Sync. Turn this off and your configuration will not sync between your passive/active members.

Re: push the commit on one member of the cluster only?

pmartyn — Thu, 31 Aug 2017 08:23:34 GMT

@BPry,

With this option disabled, i'm able to shut interfaces on one members only :
admin@panel1(active)> show interface all
ethernet1/1 16 ukn/ukn/down(power-down) 00:1b:17:00:23:10
ethernet1/2 17 ukn/ukn/down(power-down) 00:1b:17:00:23:11

admin@panel2(passive)> show interface all
ethernet1/1 16 1000/full/up 00:1b:17:00:23:10
ethernet1/2 17 1000/full/up 00:1b:17:00:23:11

Exactly what i was looking for, thanks for your help.

But HA do not react with the following "link monitoring" configuration.

high-availability {
...
group {
35 {
   ...
   monitoring {
    link-monitoring {
     link-group {
      "LACP Group1" {
       interface [ ethernet1/1 ethernet1/2];
       failure-condition all;
      }
     }
    }
   }
}
}
}

Re: push the commit on one member of the cluster only?

Raido_Rattameister — Fri, 01 Sep 2017 13:58:49 GMT

Path and link monitoring configuration is per firewall and this is not syncronized to other firewall.

Re: push the commit on one member of the cluster only?

pmartyn — Mon, 04 Sep 2017 12:11:03 GMT

@Raido_Rattameister,

This management article https://live.paloaltonetworks.com/t5/Management-Articles/Logical-Shutdown-of-an-Interface-Does-Not-Cause-HA-Failover/ta-p/56239 explains why a logical shutdown of an interface does not cause HA failover.

Re: push the commit on one member of the cluster only?

Raido_Rattameister — Mon, 04 Sep 2017 12:19:01 GMT

Yes that is the case.

But to answer your initial question - if you change link monitoring config on one firewall and commit then this is not replicated over as link and path monitoring configuration is private to the firewall.