topic Re: HA Questions in General Topics

HA Questions

peterpan13888 — Tue, 17 Sep 2013 18:19:57 GMT

Hi all,

I have 2 simple questions:

Q1: proper procedure to physically move the standby firewall PA3020 connected to primary firewall within the same datacenter (need to power off and move)?

Q2: proper procedure to switch the primary to standby and standby to primary firewall?

Thanks a lot!!

Peter

Re: HA Questions

mbutt — Tue, 17 Sep 2013 18:33:16 GMT

1. If the cables are going to get disturbed then yes you should power off the device.

2. From GUI you and suspend the device and the passive will become active at that time. Unless you want passive to be suspended itself.

You can achieve this by going to Device ---> high availability

or you can do this from CLI

request high-availability state suspend

request high-availability state functional

Hope that helps.

Thanks

Numan

Re: HA Questions

peterpan13888 — Tue, 17 Sep 2013 20:17:13 GMT

Thanks! Still not very clear:

Q1. I need to physically move the standby firewall, so should I:

a - suspend standby FW (optional?)

b - power off standby FW

c - move standby FW

d - power up standby FW

e - re-connect with primary firewall

f - unsuspend standby FW

My fear is that the standby firewall will become active if it believes the primary is down if the move is not executed properly: both active and secondary will be up.

Re: HA Questions

shasnain — Tue, 17 Sep 2013 20:35:08 GMT

Hi,

If you suspend the standby unit and power it down and move it and then power it back up it will become functional upon the reboot. If your Current Active unit has lower priority then the standby unit then the standby should come up as standby(Passive).

Thanks,

Syed R Hasnain

Re: HA Questions

peterpan13888 — Tue, 17 Sep 2013 20:53:58 GMT

Not sure the last sentence? I thought if the active unit has lower priority, then the standby may take over as primary when it powers up if it has higher priority?

Re: HA Questions

shasnain — Tue, 17 Sep 2013 21:07:12 GMT

The unit with the lower priority will be active and the unit with the higher priority will be passive.

Re: HA Questions

apasupulati — Wed, 18 Sep 2013 15:08:25 GMT

With preempt enabled on both the HA peers (option is under Ha election settings), the peer with the lowest device priority will always preempt to be the Active firewall.

Thanks,

Aditi

Re: HA Questions

VinceM — Thu, 19 Sep 2013 08:31:30 GMT

Hi,

Just be sure to disable preempt (Device / HA / election settings) on both FW and then follow your procedure. When the moved fw will come up, he will re integrate the HA as backup then no issue.

Keep us in touch.

Re: HA Questions

peterpan13888 — Thu, 19 Sep 2013 14:42:13 GMT

My 2 firewalls in active-passive mode were pre-configured and they have the same priority numbers. Should I change them if I want to keep active-passive mode?

Thanks!

Re: HA Questions

HULK — Thu, 19 Sep 2013 15:46:20 GMT

Hello,

It is recommended to configure different priorities on both the firewalls in order to maintain a healthy HA environment. Lower values will be higher in priority.

Example:

Firewall- A = priority 100

Firewall -B= priority 200

If you reboot both firewalls at the same time, firewall A will become active and B will become passive. Also it will help you with "preempt" option.

Thanks

Re: HA Questions

shasnain — Thu, 19 Sep 2013 19:24:19 GMT

If you are using the preemption feature on your HA. The firewall with the lower priority will always be active and the firewall with the higher priority will be passive. If for some reason your active device reboots or goes down the passive will take over but as soon as the active comes back up it will again become the master of the cluster(active). As mentioned above its a good practice to have different priorities on the active and passive unit.

Thanks,

Syed R Hasnain

Re: HA Questions

peterpan13888 — Thu, 19 Sep 2013 19:30:53 GMT

Thanks and I agree.

Re: HA Questions

Retired Member — Sat, 21 Sep 2013 21:33:04 GMT

You are afraid about split brain.

use backup for management with selecting Heartbeat backup.

I already did what you want to do without preemptive option.just manually flap, powered off the main device.After powering on manually switched the devices again.