HA recovery advice after upgrading Active first

MCmgt — Fri, 18 Jan 2013 14:53:44 GMT

Being a newb and never having updated my Active/Passive HA pair, I took the 4.1.10 release notes at face value. There is no mention of special provisions for HA upgrades so I clicked "install" and now have a 4.1.10 Active member and a mismatched 4.1.7 passive member. Having now read the full product documentation I understand the "proper" way to upgrade an HA pair.

What are my best options for proceeding from here?

Re: HA recovery advice after upgrading Active first

gswcowboy — Fri, 18 Jan 2013 15:19:44 GMT

Active is passing traffic so now, only recourse is to proceed with your passive upgrade.

Re: HA recovery advice after upgrading Active first

panman — Fri, 18 Jan 2013 15:56:47 GMT

I did the same thing too the first time.

Basically what you want to do is revert the firewall you upgraded, and then when the HA pair is back how they were running 4.1.7, you can start over and follow the proper method.

If I remember correctly, this should work...

On active (4.1.10) firewall you upgraded, export the last several configs that the system saved before and after you upgraded the firewall. You can do this from Setup>Export>Export>Config Verison in the GUI. This step is precautionary, just so you have a copy of the config it was running before and after you upgraded the firewall.
Next, make sure the running configs are synced in the GUI's Dashboard>HA pane. This will ensure your latest config will be retained on the HA pair.
Suspend your primary (4.1.10) firewall using the Device>HA>Operation Commands>'suspend local device' in the GUI, or the "request high-availability state suspend" from CLI. The 4.1.7 firewall will now be the active firewall.
Now in Device>Software you can install the 4.1.7 software to revert the firewall back. After it reboots, the config (we just synced) from the active 4.1.7 firewall will be pushed over.
Both firewalls are now running the same OS again, and you can make the downgraded firewall the active node again by performing the 'suspend' and 'make functional' procedure on the opposite firewall.

Now you are back to square one, and you can follow this guide for the correct procedure to upgrading a clustered pair:

topic Re: HA recovery advice after upgrading Active first in General Topics

HA recovery advice after upgrading Active first

Re: HA recovery advice after upgrading Active first

Re: HA recovery advice after upgrading Active first