topic VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario in Firewall and Security Management

VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

KostasGR — Fri, 05 Feb 2021 17:03:10 GMT

Hello

Does anyone knows if a VS on a VSX cluster (VSLS mode) can be on active/active mode in normal or in a split brain scenario?

In case of split brain scenario is a way to force a VS that is on down state on that VSX( VSLS mode) become active?

BR,

Kostas

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

Bob_Zimmerman — Fri, 05 Feb 2021 19:06:42 GMT

It's theoretically possible, but only if neither one can see cluster heartbeats from the other, and both can ping something on every interface. I could contrive such an environmental disruption, but it would be extraordinarily unlikely for random failures to result in both members claiming to be active.

I don't know of a way to force a down member to become active.

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

Chris_Atkinson — Sat, 06 Feb 2021 10:51:16 GMT

What is the hardware platform & version involved, also is this for L2 or L3 virtual systems?

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

KostasGR — Thu, 08 Apr 2021 16:20:53 GMT

Hello Chris

The version is r80.30 and they are L3 VS and not bridge VS L2.

Consider a scenario you have two data centers with Layer 2 Data Center Interconnection and one site is totally destroyed by a meteor or a flood for example or the lines that interconnect them are out of service (most probable scenario).

BR,

Kostas

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

genisis__ — Sat, 10 Apr 2021 14:12:29 GMT

vsenv <id>

clusterXL_admin down

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

Bob_Zimmerman — Sat, 10 Apr 2021 18:09:34 GMT

That forces an active context in VSLS to become down. 'clusterXL_admin up' clears the artificially-down status, but does not force the member to become active. If the member thinks it is unhealthy for another reason and the active contention mechanism has failed, it will refuse to take over, and I don't know of a way to force it to.

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

Bob_Zimmerman — Sat, 10 Apr 2021 18:17:46 GMT

One site being destroyed isn't really split-brain. If one whole datacenter is gone, then the other member should take over because it's still there.

If the interconnect between the datacenters fails, that would be split-brain, sure. Depending on the rest of the environment (in particular, whether there are things in both datacenters which respond to pings from the firewalls), that could result in both members becoming active, though they wouldn't conflict with each other, as the link between the datacenters is down.

This has complicated implications if the two cluster members have totally independent connectivity to the same things outside the datacenters. For example, if they each have their own Internet connection, and they talk BGP with the telco, that could result in both of them trying to claim to be the right path for the AS, which could result in anycast-style traffic flow.

If the DC-to-DC link goes down, and one member decides it isn't healthy enough to take over, I don't know of a way to force it to take over anyway.

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

genisis__ — Sun, 11 Apr 2021 09:20:04 GMT

so the scenario is DC to DC link gone down, both members now active and you need to force the traffic down one of the member only, so we are attempting to treat the symptom here and not address the root cause.

Possible things to try:

- cpstop on the member you want down?

- Shutdown all interfaces except Management on the member?

- cphastop?

- shutdown the node via LOM.

- Clearly - resolve the DC to DC issue.

Above is all I think of unless TAC have another suggestion.

Re: VS on a VSX cluster (VSLS mode) can be on active active mode in normal or split brain scenario

Bob_Zimmerman — Sun, 11 Apr 2021 14:59:37 GMT

Again, that works to force a member down. That wasn't the question asked, though. The original post asks if there is a way to force a VS which is currently down to become active.