topic Re: Remove bond interface in Firewall and Security Management

Remove bond interface

Pradeep_Salunke — Wed, 24 May 2023 16:39:11 GMT

What precautions need to take before removing bond interface?

Remove bond interface from gateway and remove it from management server?

need to install the policy.

Any other steps need to take care?

Please suggest

Re: Remove bond interface

the_rock — Wed, 24 May 2023 16:44:01 GMT

Regardless of which interface, steps to take are:

1) Remove from OS level (web UI or clish)

2) Update topology in smart console gateway object

3) Install policy

4) Verify all still works

Andy

Re: Remove bond interface

Pradeep_Salunke — Wed, 24 May 2023 16:50:05 GMT

If we performed the get interface without topology thus affect anything?

Re: Remove bond interface

the_rock — Wed, 24 May 2023 16:54:06 GMT

Make sure to do get interfaces WITHOUT topology. If you do WITH, it will reset your current settings.

Cheers,

Andy

Re: Remove bond interface

Bob_Zimmerman — Wed, 24 May 2023 17:17:31 GMT

Of note: removing the bond from the OS level requires removing the member interfaces from the bond. I would also do that step last. You really should not delete an interface which the firewall software still knows about. It can cause all kinds of weird traffic problems.

Remove interface from topology table in SmartConsole
Push policy
Disable interfaces at the OS level (e.g, shutdown the attached switch ports)
Test
If everything tests good, remove the bond's member interfaces, then delete the bond

Re: Remove bond interface

the_rock — Wed, 24 May 2023 17:26:44 GMT

Thats true, good point, it does require removing member interfaces, thank you for pointing that out. But, even TAC would suggest to remove it from OS level first, then topology...at least thats how they always did it in the past.

Andy

Re: Remove bond interface

Bob_Zimmerman — Wed, 24 May 2023 20:40:41 GMT

If someone in the TAC suggested that order to me, I would request the call be transferred to somebody else.

When adding an interface, you must add at the OS level first, then the application level.

When removing an interface, you should tell the application to stop using the interface before you tell the OS to stop providing the interface to be used. While in most circumstances you can do it in the other order (remove from OS first, remove from application second), that leaves the application trying to use something which doesn't exist. The best case situation for that is cluster failovers when a monitored interface goes down. It could easily result in flapping or a hard outage if combined with other interface problems or cluster monitoring problems.

It's like using a cable for cluster sync: technically supported, but a bad idea which will cause problems sooner or later.

Re: Remove bond interface

the_rock — Wed, 24 May 2023 21:24:32 GMT

Respectfully, I would disagree. I had done it the way TAC suggested many times before and never had a problem. If you think about it, all smart console would do is really get information based on whats configured on OS level, so to me, makes total sense to do it same way when adding OR removing the interface.

Andy

Re: Remove bond interface

Bob_Zimmerman — Thu, 25 May 2023 14:46:25 GMT

Think about it with VSX. If you remove the bond from the OS level first, then you try to remove it from your VSX object, provisioning will fail.

Re: Remove bond interface

the_rock — Thu, 25 May 2023 14:49:25 GMT

Im sure you know VSX way better than I do, so Im positive thats correct. As far as regular gateways, I always done it how TAC suggests and never had a problem.

Just my experience...

Andy

Re: Remove bond interface

Pradeep_Salunke — Thu, 25 May 2023 16:37:05 GMT

I have removed the bond interface and performed the fetch without topology. after activity i can seen that topology is undefined.

So we need to manually edit the same. I have took screenshot before activity.?

Re: Remove bond interface

the_rock — Thu, 25 May 2023 16:38:58 GMT

Yes, please send a screenshot indicating the settings.

Andy

Re: Remove bond interface

Pradeep_Salunke — Thu, 25 May 2023 16:47:25 GMT

i don't have individual setting i.e. what is anti-spoofing settings.

Sorry to say that is not bond interface, that is VLAN interface under that bond 2.

I have removed the vlan interface.

Re: Remove bond interface

the_rock — Thu, 25 May 2023 16:49:04 GMT

As long as interface is not part of OS, then topology should reflect that, for sure.

Andy