topic Dynamic Updates only on Active HA Member. in General Topics

Dynamic Updates only on Active HA Member.

RobinClayton — Thu, 10 May 2018 15:37:51 GMT

Our active HA member failed last week, and that highlighted that the passive had a couple of minor issues with the Dynamic update configurationa and email configuration which we fixed.

Howevr it's also highlighted another issue.

Our "Content Updates" are set to update directly out of the firewall external interfaces, yet on the now "Passive" unit these are shut down, so the unit can't update and sends out alerts.

The New "active" unit is updating and Syncing the updates across.

Is there a way ( other than manual disabling Dynamic Updates Manual) to specify that only the "Active" unit checkes and updates content????

Cheers

Rob

Re: Dynamic Updates only on Active HA Member.

OtakarKlier — Thu, 10 May 2018 16:32:53 GMT

Hello,

Not really. What I have done with good success is to have both perform updates with the options to sync to peer. They are set at different time intervals so they dont step on each other. Also I use the management interface as the source so it can always go out.

Regards,

Re: Dynamic Updates only on Active HA Member.

BPry — Thu, 10 May 2018 17:46:38 GMT

@RobinClayton,

As @OtakarKlier mentioned the fix to this would really be setting the service route for dynamic updates to use the management interface if you are able to do so. If for some reason you can't use the management interface for some reason, the current best practice is to utilize the "Sync-to-peer" option with 30 minutes gap between update schedules on both units. This is to prevent the firewalls 'syncing' to the peer firewall at the same time, causing both syncs to fail.

Re: Dynamic Updates only on Active HA Member.

RobinClayton — Fri, 11 May 2018 08:08:05 GMT

I do have them both set Sync-To-Peer , at different intervals. But The alert is still generated on the passive device.

I could use the management interface but then I need to add a new rules to the firewall to allow it to get to the content. I guess App-id "paloalto-updates" should be all I need.

Cheers

Rob

Re: Dynamic Updates only on Active HA Member.

BPry — Fri, 11 May 2018 12:52:42 GMT

@RobinClayton,

Ya if you could use the management interface I would personally just recommend doing that. The applications that should be identified are [ paloalto-wildfire-cloud paloalto-updates pan-db-cloud ] and possibly ssl