topic Re: Swapping the roles of Firewalls in HA Pair in General Topics

Swapping the roles of Firewalls in HA Pair

R_Sharma — Thu, 09 Aug 2018 03:33:21 GMT

Hi Guys

I want to swap the Active/passive roles of the Firewalls in HA pair and let it run for couple of weeks.

I know that can be done by 'suspending the role' from GUI and from CLI too.

want to be careful about pre-emption and donot want to break the HA pair.

Does suspending teh device on active means forcing the device to be passive plus taking it off from HA pair?

any tips that needs to be taken care of?

Thanks

Re: Swapping the roles of Firewalls in HA Pair

RobinClayton — Thu, 09 Aug 2018 08:09:37 GMT

Disable pre-empt on both, suspend the local active, done.

I don't have pre-empt on anymore as I would rather failover and run on the other device until I decide the time is right to switch back.

Re: Swapping the roles of Firewalls in HA Pair

santonic — Thu, 09 Aug 2018 08:57:25 GMT

Suspending device means making it non-functional. So yes in a way it's like taking it out of a cluster as it won't take active role again even if the other shuts down.

So you want to make it functional again asap. Pre-emptive will control how cluster behaves when primary device returns.

Re: Swapping the roles of Firewalls in HA Pair

fjwcash — Fri, 10 Aug 2018 18:08:03 GMT

@RobinClayton wrote:
Disable pre-empt on both, suspend the local active, done.

That breaks the HA config leaving you running on only a single firewall. You forgot the last step, un-suspend the now passive box, in order to re-add it to the HA pair. 🙂

1. Make sure pre-empt is disabled on the active firewall and the passive firewall.

2. Suspend the active firewall, thus forcing a fail-over event, switching the roles of the two firewalls.

3. Re-enable the (now) passive firewall, to re-add it to the HA pair.

Re: Swapping the roles of Firewalls in HA Pair

RobinClayton — Mon, 13 Aug 2018 08:04:16 GMT

Yeah, I only ever realy suspend when patching so the suspended unit gets rebooted and becomes active anyway.

Rob

Re: Swapping the roles of Firewalls in HA Pair

R_Sharma — Fri, 17 Aug 2018 00:53:14 GMT

@santonic

Thank you. I am talking in terms of upgrading the firewalls in HA pair. As my passive firewall doesn;t use service enroute interface as management interface, it is unable to download the software.

So I have to dis-able and re-enable pre-emp after or before every reboot?

Re: Swapping the roles of Firewalls in HA Pair

santonic — Fri, 17 Aug 2018 07:22:01 GMT

Preemption controls what happens when higher priority device returns from down/non-functional state to functional, nothing else.

If it's on, higher priority device becomes active when it returns from down/non-functional state

If it's off, higher priority device becomes passive when it returns from down/non-functional state

Decide how you want your cluster to behave, then control it with preemption.