HA Link and Path Monitoring

Alpalo — Tue, 14 Sep 2021 15:43:28 GMT

Hello everyone

We have configured active-passive HA on a pair of 5220

I have configured link monitoring

I need to migrate the HA links of the FW , all except the backup HA1 management one.

What would be the best procedure to prevent them from becoming active?

Is there any way to check end to end after each change, apart from looking at the link up????

I am thinking making the passive node non-funcional but I'm not sure.

Thanks

Re: HA Link and Path Monitoring

PavelK — Tue, 14 Sep 2021 21:36:22 GMT

Thank you for posting question @Alpalo

Personally, I would suggest to suspend Firewall you will be working on by going to High Availability > Operational Commands > Suspend local device. I would also recommend to disable Preemption under: High Availability > General > Election Settings. This will give you a control which device will be active regardless of configured priority.

Regarding checking after processing each step, I would recommend to go to CLI and issue: show high-availability interface <HA Interface Name>, then make sure you see bytes received and transmitted. By issuing this command multiple times, you will see statistics to be increasing for bytes received and transmitted to make sure basic connectivity is there.

Note: HA configuration is not synchronized between Firewalls, so you will have to make sure that HA configuration is consistent across both Firewalls.

Kind Regards

Pavel

topic HA Link and Path Monitoring in General Topics

HA Link and Path Monitoring

Re: HA Link and Path Monitoring