topic Re: VSX vsls - Active up vs Primary up in Firewall and Security Management

VSX vsls - Active up vs Primary up

Mattias_Jansson — Wed, 19 Jan 2022 09:00:15 GMT

Hi!

Im trying to find information about the new feature starting from R80.40:

Support for Active Up mode in VSLS.

I cannot find detailed information about this setting in the R80.40 VSX documentation except that the behaviour can be changed with: vsx_util vsls - 5. Toggle VSLS mode between Active Up and Primary Up"

Anyone who knows more about this or where I can find the information?

Re: VSX vsls - Active up vs Primary up

Kaspars_Zibarts — Wed, 19 Jan 2022 09:25:48 GMT

You're spot on - documentation does not exist to explain it 🙂

Wild guess: primary up would mean higher priority would always be active if it's available, whereas active up would keep current active member even though member with higher priority becomes available.

Or in more practical example, say if you are upgrading VSX1 that has higher priority then after upgrade VSX2 will remain active even it has lower priority. Just like regular cluster setting

Re: VSX vsls - Active up vs Primary up

Mattias_Jansson — Wed, 19 Jan 2022 09:35:17 GMT

That was my guess too. The documentation says:

Failure Recovery

When the failed VSX Cluster Member or Virtual System comes back online, the system returns to its original Load Sharing configuration.

So that would be Primary Up mode, and Active Up (which is not mentioned) is that it stays on the current host.

Re: VSX vsls - Active up vs Primary up

Mattias_Jansson — Wed, 19 Jan 2022 09:36:12 GMT

Nice feature by the way! 🙂

Re: VSX vsls - Active up vs Primary up

Kaspars_Zibarts — Wed, 19 Jan 2022 09:45:21 GMT

yeah, it was always a bummer during upgrades 🙂 or even regular restarts when you wanted to keep it on a specific cluster member, so you would always have to keep playing with vsx_util

Re: VSX vsls - Active up vs Primary up

Kaspars_Zibarts — Fri, 04 Feb 2022 06:36:28 GMT

A small but important update! We tried it in production.. please remember to book an outage window if you are switching modes! As this is what happened 😲😱

First you will be asked to use option "6" after changing modes which does not make sense at all:

But then menu structure changes from 8 items to 9 and option "6" actually makes sense:

Now! Running it will cause multiple VS failovers and eventually all VSes will go down briefly as shown in the first screenshot

Re: VSX vsls - Active up vs Primary up

Henrik_Noerr1 — Thu, 22 Jun 2023 09:21:15 GMT

Hey,

I am failing to understand the exact behaviour here. Is this only for VS0 as indicated here:

VSX cluster questions: Failover & updatable objec... - Check Point CheckMates

or all VS ? and if it is for all VS - what does the priority setting do here? Only apply for vsls redistribute?

I am trying to accomplish that the cluster does NOT failback to the rebooted node. This has only caused issues for us.

Another question, does this really bring down all virtual systems ? have you seen it on other clusters or was it a one of and for how long did you see it?

Thanks!

Henrik

Re: VSX vsls - Active up vs Primary up

Kaspars_Zibarts — Thu, 22 Jun 2023 09:35:35 GMT

Hi. The mode is applied on all VSes. So if you chose "Active UP" it will maintain currently active VS and will ignore any priority / weight settings. Indeed this should help you avoiding failback after reboots.

Changing the mode did bring down all VSes in our case. But it was only one cluster in our case. How long - I don't remember exactly but lets say outage was roughly 5mins before all settled again.

Regards, Kaspars

Re: VSX vsls - Active up vs Primary up

DimitrisK — Thu, 15 Feb 2024 08:30:36 GMT

Hello all,

I have a question about failover status after vsx member is recovered.

In this example there is a cluster of 2 members (Active-Standby) in vsls "Primary UP" mode.
vsx1 priority 0 (active) , vsx2 priority 1 (standby)

1) via vsx_util vsl (opt.3) move all VS from currently Active (vsx1) to Standby (vsx2).
This causes failover of every VS and their the traffic, and the "active" is the vsx2 now

2) reboot vsx1

3) -that's the unclear point-
After vsx1 reboot, will it be active automatically, and cause failover of the traffic from vsx2, (because of vsls "Primary UP" mode),
or there will not be any traffic failover, because it was configured in vsx_util (step 1 -above), and as per documentation "the system returns to its original Load Sharing configuration"?

Re: VSX vsls - Active up vs Primary up

Kaspars_Zibarts — Fri, 16 Feb 2024 06:23:59 GMT

After reboot all VSes will return to VSX1 as it has higher priority and "Primary-UP" mode.

"Active-UP" mode would have preserved VSX2 as active after reboot.

Re: VSX vsls - Active up vs Primary up

CP_Chris — Thu, 01 May 2025 15:30:59 GMT

Just an update - I was playing with this in the lab using R81.20. This issue of all members going down during the mode change did not happen there. I believe the mechanism by which they change the mode is better now and will not cause an outage.