topic Re: Policy push on security gateway cluster in Firewall and Security Management

Policy push on security gateway cluster

Ratnesh_Singh — Wed, 05 Jan 2022 15:34:32 GMT

Hi Team,

I need some clarification. When we are installing policy on security gateway cluster configured in HA (Active/ Standby) .On which gateway policy will get install 1st . Standby or Active or both in parallel . Thanks

Re: Policy push on security gateway cluster

the_rock — Wed, 05 Jan 2022 16:15:21 GMT

I could be wrong when I say this, but I dont believe there is a method to it. I had seen many times where backup member gets policy first, but then in lots of cases, its master that gets done before backup.

Re: Policy push on security gateway cluster

Juan_ — Thu, 06 Jan 2022 09:58:59 GMT

Hi Ratnesh,

It really doesn't make a difference, policy will start applying once the active gets it, whilst the standby is on-freeze and not getting data connections.

Having said that, Which one "installs first" will depend on many factors but mainly:

Which member gets the policy files on $FWDIR/state/__tmp/FW1 first
- This will depend if the standby is a silent standby, or independent with different network speeds from manager to active and manager to standby
Which one processes those files first
- Here, as you guess, will depend on the resources available. In general, a standby member is idler than the active so it installs the policy first.

Hope that helps.