topic Re: 1400 Manual Cluster Failover in Firewall and Security Management

1400 Manual Cluster Failover

biskit — Wed, 23 Jan 2019 19:49:51 GMT

Hi all,

I'm struggling to remember or find the answer to how you manually fail over a 1400 cluster. The normal "clusterXL_Admin down" doesn't work on 1400's.

I've set the other member to the higher priority in SmartDashboard and set ClusterXL to switch to higher priority member, then installed, but it hasn't switched.

Any ideas how I can manually fail over between cluster members on 1400's?

Thanks,

Matt

Re: 1400 Manual Cluster Failover

Matt_Ricketts — Thu, 24 Jan 2019 05:52:15 GMT

Are you able to physically unplug one of the Ethernet cables in the 1400 and force fail over?

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Thu, 24 Jan 2019 06:42:21 GMT

The SMB devices are a little bit different as they run Gaia embedded. Performing the following will perform the failover in the same manner as the Gaia full devices (3000 series and above).

# Complete in Expert mode

cd $FWDIR/bin

clusterXL_admin.csh down

Re: 1400 Manual Cluster Failover

G_W_Albrecht — Thu, 24 Jan 2019 11:52:41 GMT

That is all documeted here: sk65060: How to cause a manual fail-over in ClusterXL on SG-8x appliances.

Re: 1400 Manual Cluster Failover

Maarten_Sjouw — Thu, 24 Jan 2019 11:56:14 GMT

The actual simplest way to do so, is by using the priority in the SmartConsole, as it is centrally managed, that is where it should be, open the cluster object, Cluster members and adjust the priority and push the policy.

For the quick switch the only way is to use the CLI as described in the previous posts.

Re: 1400 Manual Cluster Failover

G_W_Albrecht — Thu, 24 Jan 2019 11:59:00 GMT

If it is centrally managed - even 14x0 SMBs can be used locally managed.

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Thu, 24 Jan 2019 12:06:47 GMT

When using the priorities (with central management with SMS) if the failover settings within advanced settings are set to "Maintain Current Active Cluster Member" then the unit won't failover based on the priorities.

If you want to perform failover using the priorities you will need to change to "Switch to higher priority cluster member" and then install policy.

Re: 1400 Manual Cluster Failover

Gaurav_Pandya — Thu, 24 Jan 2019 15:10:32 GMT

Correct. You need to change option to "Switch to higher priority cluster member" in clusterXL setting.

Re: 1400 Manual Cluster Failover

biskit — Thu, 24 Jan 2019 15:14:19 GMT

Thanks everyone.

I've already set to highest priority and installed (as mentioned in the original post) but this did not switch members. I don't know why not.

I'll try the clusterXL_admin.csh command tonight during a maintenance window

Matt

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Thu, 24 Jan 2019 15:18:25 GMT

Not a problem at all.

Just to confirm within your SMS have you set the "Switch to higher priority Cluster Member" option as pictured earlier?

If it's easier, feel free to post a screenshot and we can see if we can see anything that may be causing the issue.

Re: 1400 Manual Cluster Failover

biskit — Thu, 24 Jan 2019 15:37:47 GMT

Here's my settings:

However, even after multiple installs, FWA is still Standby. It should now be Active.

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Thu, 24 Jan 2019 15:42:40 GMT

Very Interesting, it looks ok to me from a clusterXL configuration point of view. What firmware version are you running?

I have a pair of 1450 for lab use so I'll see if I can replicate the same results.

Re: 1400 Manual Cluster Failover

biskit — Thu, 24 Jan 2019 15:56:46 GMT

Thanks. I'm currently running on R77.20.70.

Re: 1400 Manual Cluster Failover

JozkoMrkvicka — Fri, 25 Jan 2019 09:36:13 GMT

There is no option in SmartView Monitor to perform failover ? Try to right click on active member within Monitor.

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Fri, 25 Jan 2019 09:43:02 GMT

Hey Matt, how did you get on within your maintenance window and the failover with the command clusterXL_admin.csh?

Re: 1400 Manual Cluster Failover

Mark_Mitchell — Fri, 25 Jan 2019 09:51:58 GMT

Please see below for SK for Best Practices on Manual Check Point failover.

Best Practices - Manual fail-over in ClusterXL

I would always recommend this method of a fail over. As from the CLI you can also obtain more detailed data quickly around clustered interfaces and cluster health etc.

Re: 1400 Manual Cluster Failover

biskit — Fri, 25 Jan 2019 09:54:12 GMT

The clusterXL_admin.csh down worked a treat

One day the commands might be consistent between CP appliance models

Re: 1400 Manual Cluster Failover

Martin_Valenta — Fri, 25 Jan 2019 13:14:37 GMT

in expert mode, ip link set dev LANx down/up