VSX appliance upgrade to R80.40 T118 - second attempt

Kaspars_Zibarts — Thu, 08 Jul 2021 09:33:53 GMT

This is a followup on my previous post VSX-appliance-upgrade-to-R80-40-T78-first-impressions That article has grown too long and messy 🙂

We did second attempt (first one was sadly rolled back after a week) with our biggest VSX cluster running on 26800T in HA mode. Prior upgrade it was running R80.30 T219

Here couple of important observations if you are running fairly high traffic volumes

This particular VSX cluster had Virtual Router and CPU load started gradually growing after upgrade eventually hitting 100% utilisation on the VR CPU. Fix for this to disable following global kernel parameter. Apparently it disables dynamic dispatcher. I can't stress enough - it only affected cluster with virtual router and it was HA cluster rather than VSLS.

fwmultik_temp_conns_enabled 0
Bucket allocation kernel parameter between SXL and CoreXL requires two reboots when installing T118 after upgrade as described here Problems-with-large-VSX-platforms-running-R80-40-take-94 by @genisis__
You can check it by running command below, it should return number of SXL cores!

fw ctl get int fwmultik_gconn_segments_num
SNMP v3 user stops working. Fix is here SNMP V3 User Fix . For some reason you might need to run the procedure twice to get it to work
Captive Portal not reachable. Fix is here sk170433 . Rather annoying as I was hoping this would be fixed by now
Captive Portal does not display company logo. I gave up creating new case. Just copied manually our logo to:

/opt/CPNacPortal/htdocs/nac/images/cp_logo_1.png

Most importantly - R80.40 is showing solid CPU usage improvements! 🙂

topic VSX appliance upgrade to R80.40 T118 - second attempt in Firewall and Security Management

VSX appliance upgrade to R80.40 T118 - second attempt