topic Re: VSX Virtual Systems Issue in Firewall and Security Management

VSX Virtual Systems Issue

xLadyMorgana — Wed, 13 Nov 2024 16:31:25 GMT

Hi All,

I'm building a new VSX in our environment and noticed that when creating virtual systems, they are not being created with HA and keep giving the 'HA module not started' when running the cphaprob stat command. i can't seem to figure out how to turn this on. Does anyone have any insight on this? I do have a TAC case open but figured I'd try to get some knowledge here as well.

This VSX cluster does have VSLS enabled.

Re: VSX Virtual Systems Issue

PhoneBoy — Wed, 13 Nov 2024 17:09:33 GMT

Have you installed policy to the VS in question?
Also what version/JHF is this?

Re: VSX Virtual Systems Issue

xLadyMorgana — Wed, 13 Nov 2024 20:39:18 GMT

This is on R81.20 take 84.

The policy actually keeps failing to push on the VS due to updatable object issue saying the package is missing on the gateway. I'm thinking this might be something related to DNS, as I've seen this error before due to a DNS issue.

I will say tho also, shouldnt the Virtual systems be automatically created with HA? regardless of a DNS issue.

Re: VSX Virtual Systems Issue

JozkoMrkvicka — Wed, 13 Nov 2024 22:47:19 GMT

As already mentioned, you have to install policy after VS creation.

If you have troubles with policy installation for existing policy package, try to create new policy package with any-any-any-drop rule as the only rule and install it on newly created VS.

Re: VSX Virtual Systems Issue

PhoneBoy — Thu, 14 Nov 2024 13:42:00 GMT

HA status is, at least partially, a function of the installed policy.
No policy, no HA.

Re: VSX Virtual Systems Issue

xLadyMorgana — Thu, 14 Nov 2024 15:14:12 GMT

Thank you PhoneBoy. I definitely did not realize that the HA would show as not started if there was no policy.

Re: VSX Virtual Systems Issue

xLadyMorgana — Thu, 14 Nov 2024 15:15:20 GMT

We did try this and still failed. I will need to dig deeper internally once again and see if the networking side of things is configured properly. Thank you

Re: VSX Virtual Systems Issue

xLadyMorgana — Tue, 26 Nov 2024 14:44:02 GMT

Just to keep this thread up to date. it looks like the team who configured the switch side of things had changed the native vlan from the default, which is not supported. once that was changed back to default, we were able to push policy.

Re: VSX Virtual Systems Issue

Chris_Atkinson — Wed, 27 Nov 2024 00:56:05 GMT

sk120684 documents this when working with Bonds.