Dynamic Updates only on Active HA Member.

L4 Transporter

Dynamic Updates only on Active HA Member.

Our active HA member failed last week, and that highlighted that the passive had a couple of minor issues with the Dynamic update configurationa and email configuration which we fixed.

 

Howevr it's also highlighted another issue.

 

Our "Content Updates" are set to update directly out of the firewall external interfaces, yet on the now "Passive" unit these are shut down, so the unit can't update and sends out alerts.

 

The New "active" unit is updating and Syncing the updates across.

 

Is there a way ( other than manual disabling Dynamic Updates Manual)  to specify that only the "Active" unit checkes and updates content????

 

Cheers

 

Rob

L7 Applicator

Re: Dynamic Updates only on Active HA Member.

Hello,

Not really. What I have done with good success is to have both perform updates with the options to sync to peer. They are set at different time intervals so they dont step on each other. Also I use the management interface as the source so it can always go out.

 

Regards,

 

 

L7 Applicator

Re: Dynamic Updates only on Active HA Member.

@RobinClayton,

As @Otakar.Klier mentioned the fix to this would really be setting the service route for dynamic updates to use the management interface if you are able to do so. If for some reason you can't use the management interface for some reason, the current best practice is to utilize the "Sync-to-peer" option with 30 minutes gap between update schedules on both units. This is to prevent the firewalls 'syncing' to the peer firewall at the same time, causing both syncs to fail. 

L4 Transporter

Re: Dynamic Updates only on Active HA Member.

I do have them both set Sync-To-Peer , at different intervals. But The alert is still generated on the passive device.

 

I could use the management interface but then I need to add a new rules to the firewall to allow it to get to the content. I guess App-id "paloalto-updates" should be all I need.

 

Cheers

 

Rob

 

L7 Applicator

Re: Dynamic Updates only on Active HA Member.

@RobinClayton,

Ya if you could use the management interface I would personally just recommend doing that. The applications that should be identified are [ paloalto-wildfire-cloud paloalto-updates pan-db-cloud ] and possibly ssl

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!