Question regarding VM series HA after a hardware failure

[ccfalkner]

I am new to VM series PAs and looking into how to setup HA.  So it is interesting that the license is attached to the host and VM file location.  Any change in this needs a re-registration of the license via tech support.  Even using VMotion would trigger a need for a support call.  I then assumed that I could put one VM on a separate Hypervisor in case of a hardware failure, but then while setting up HA, I checked a help screen that stated a requirement for HA is that both VMs are on the same Hypervisor.  So, it sounds like this configuration is vulnerable to a hardware failure on the host, which doesn't sound like good HA to me.  How is this mitigated, or am I missing something?

Thanks,

ccfalkner 

[jvalentine · Accepted solution]

I v-motion my VM-Series firewalls all the time and haven't ever had to contact support for licensing issues.  

They are configured in an Active-Passive HA Pair and are almost always located on different hosts to protect against hardware failure.

"Same Hypervisor" configuration recommendation for High Availability probably means that they both need to be running on ESXi, not one on ESXi and another on Hyper-V (or KVM, or Citrix Netscaler, etc.)  

[ccfalkner · Accepted solution]

That is good to hear.  I specifically asked about VMotion in a support call and received the information I stated.  I am glad that it is wrong.  It was too simple of a problem to exist.

Thanks.

[jvalentine]

Administrative operations that change the VM's UUID (clone, backup/restore, etc.) could invalidate the license, requiring you to contact support.  For these types of events, VMware usually asks the administrator if the VM was "moved" or "copied".   In these scenarios, the right answer is "moved".