topic Re: ElasticXL Appliance Sync Interface Question. in Firewall and Security Management

ElasticXL Appliance Sync Interface Question.

yukaia — Thu, 17 Apr 2025 00:18:07 GMT

Hello all,

I'm playing with my personal remote lab currently in preparation for a project at $DAYJOB to deploy three 9800's in an ElasticXL cluster and I have a question about the Sync interfaces, given that sync plays an even more important part in an ElasticXl cluster. We're looking at using a pair of sfp+ 10gbe ports per gateway for our sync, does anyone know what the supported process is to configure an ElastiXL cluster this way?

I've poked around at the appliances in my lab and noticed that there's a bond interface for Sync with the 1gbe sync port added to, I'm assuming that when I initially configure the SMO for the cluster that I can just add the two sfp+ interfaces to the sync bond and be fine, would that be correct? I'd change things up in my lab, but it's a 7 hour drive away at a friend's colo right now.

Regards,

Zack.

Re: ElasticXL Appliance Sync Interface Question.

emmap — Thu, 17 Apr 2025 02:31:11 GMT

The sync bond comes up as bonding group 1024 so I believe you can just add / remove interfaces to / from that, yes.

Re: ElasticXL Appliance Sync Interface Question.

yukaia — Thu, 17 Apr 2025 15:26:50 GMT

Thanks, that's what I was guessing, but I wasn't entirely sure.

Re: ElasticXL Appliance Sync Interface Question.

Lesley — Thu, 17 Apr 2025 19:53:45 GMT

Important:

The "Sync" ports of all ElasticXL Cluster Members in the same ElasticXL Cluster must connect to the same Layer 2 broadcast domain (a dedicated Layer 2 switch, or a dedicated VLAN).
Only one ElasticXL Cluster is supported in the same Layer 2 broadcast domain (connecting Sync interfaces of different ElasticXL Clusters is not supported).
Configuring the Sync interface as VLAN Trunk is not supported.
ElasticXL Cluster sends all traffic over the Sync network in clear-text (non-encrypted).
ElasticXL Cluster automatically configures the IP address of the sync network to 192.0.2.0/24.

If needed, later it is possible to change the IP address of the sync network.

ElasticXL Cluster renames the physical interfaces on the appliances:

The "Mgmt" interface becomes a subordinate interface in the Bond called "magg1".
The "Sync" interface is renamed to "eth1-Sync" and becomes a subordinate interface in the Bond called "Sync".

Notes - Gaia OS does not show the bond interface "Sync" (or its subordinate interfaces) in Gaia Portal and in the Gaia Clish "set" commands. This is to prevent any changes to this infrastructure interface.

Does ElasticXL Cluster support a bond of Sync interfaces?

Yes - the default configuration is a Bond called "Sync" that contains the eth1-Sync ("Sync") interface of the Security Appliance.

By design, this interface is hidden.

So indeed bond should already be there. I am not sure if you add a SFP it will automatic add it to the SYNC. It think it picks it during the initial config. It should be possible if I read this know limitation. I would just indeed to add via gaia clish

PMTR-107433

ElasticXL

Adding an unassigned interface to or from Sync bond leads to the flags reset and, as a result, it disrupts the ElasticXL detection and ElasticXL drops the packets.

Re: ElasticXL Appliance Sync Interface Question.

Bob_Zimmerman — Thu, 17 Apr 2025 20:50:34 GMT

For confirmation, here's my lab ElasticXL cluster:

[Expert@DallasticXL-s01-01:0]# clish -c "show configuration" | grep 1024 add bonding group 1024 set bonding group 1024 mode active-backup set bonding group 1024 primary eth1-Sync set bonding group 1024 xmit-hash-policy layer2 add bonding group 1024 interface eth1-Sync

Note that you should both add the interfaces you want to use and set one of them to be primary (or change the bond to a mode which doesn't have a primary). You should probably also remove eth1-Sync once you have done so.

Re: ElasticXL Appliance Sync Interface Question.

yukaia — Thu, 17 Apr 2025 20:56:36 GMT

Thanks for confirming that, I had more or less the same process in mind.