05-10-2018 08:37 AM
Our active HA member failed last week, and that highlighted that the passive had a couple of minor issues with the Dynamic update configurationa and email configuration which we fixed.
Howevr it's also highlighted another issue.
Our "Content Updates" are set to update directly out of the firewall external interfaces, yet on the now "Passive" unit these are shut down, so the unit can't update and sends out alerts.
The New "active" unit is updating and Syncing the updates across.
Is there a way ( other than manual disabling Dynamic Updates Manual) to specify that only the "Active" unit checkes and updates content????
Cheers
Rob
05-10-2018 09:32 AM
Hello,
Not really. What I have done with good success is to have both perform updates with the options to sync to peer. They are set at different time intervals so they dont step on each other. Also I use the management interface as the source so it can always go out.
Regards,
05-10-2018 10:46 AM
As @OtakarKlier mentioned the fix to this would really be setting the service route for dynamic updates to use the management interface if you are able to do so. If for some reason you can't use the management interface for some reason, the current best practice is to utilize the "Sync-to-peer" option with 30 minutes gap between update schedules on both units. This is to prevent the firewalls 'syncing' to the peer firewall at the same time, causing both syncs to fail.
05-11-2018 01:08 AM
I do have them both set Sync-To-Peer , at different intervals. But The alert is still generated on the passive device.
I could use the management interface but then I need to add a new rules to the firewall to allow it to get to the content. I guess App-id "paloalto-updates" should be all I need.
Cheers
Rob
05-11-2018 05:52 AM
Ya if you could use the management interface I would personally just recommend doing that. The applications that should be identified are [ paloalto-wildfire-cloud paloalto-updates pan-db-cloud ] and possibly ssl
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
