topic Re: How to take snapshot of firewalls under VSX in Firewall and Security Management

How to take snapshot of firewalls under VSX

pradeepsalunke — Fri, 07 Oct 2022 07:11:05 GMT

How to take snapshot of firewalls under VSX. we have vsx setup under that there are four firewalls.

Re: How to take snapshot of firewalls under VSX

Oliver_Fink — Fri, 07 Oct 2022 07:57:08 GMT

You can create snapshots via Clish: add snapshot __SHORT__ desc "__DESCRIPTION__"

You can see all snapshots with: show snapshots

You can see details of a snapshot with: show snapshot __SHORT__

Be aware if your file system is XFS. I am not sure, but this seems to be the default since R81. We had the problem that the snapshot produces a very high load with normal disks leading to a VSX node becoming unavailable and losing connections (load rises from below 5 to far above 30 on a 32 core machine). Such, we are producing snapshots only during maintenance windows after moving all VSes to another node.

Re: How to take snapshot of firewalls under VSX

Chris_Atkinson — Fri, 07 Oct 2022 08:55:56 GMT

Further to @Oliver_Fink guidance make sure you also have recovery points for the Managment server for the same point in time.

Refer also: sk100395, sk101515

Re: How to take snapshot of firewalls under VSX

Bob_Zimmerman — Fri, 07 Oct 2022 17:40:26 GMT

To directly address a potential point of confusion, a VSX box is a single firewall. One operating system, one set of logical volumes. It just has multiple VRFs.

Snapshots are an OS-level thing. Since all the VSs on a VSX box are running under the same OS, a snapshot covers all of them.

Re: How to take snapshot of firewalls under VSX

Matlu — Thu, 01 May 2025 12:29:49 GMT

Hello
What are the 'must-haves' before taking a SNAPSHOT in a productive environment?

How much minimum disk space should you have in a VSX box?
Should the #df -h command be used on the VS0, as part of the pre-validations?

Does a box volume issue also have to be validated as such before running a SNAPSHOT?

Thanks.

Re: How to take snapshot of firewalls under VSX

emmap — Fri, 02 May 2025 02:52:22 GMT

If you do a 'show snapshots' from clish on your box it will tell you if it has enough space for a new one. Snapshots are stored in unpartitioned space, so the 'df -h' output isn't relevant to them.

Re: How to take snapshot of firewalls under VSX

Matlu — Fri, 02 May 2025 11:32:42 GMT

Hi
Do you have to check the 'unpartitioned space' before taking a new SNAPSHOT?
How do you check this, and what is the ideal value you should have to be able to run a SNAPSHOT?

Re: How to take snapshot of firewalls under VSX

Bob_Zimmerman — Fri, 02 May 2025 18:08:29 GMT

Run the command 'show snapshots' in clish. It will tell you how much space is available and approximately how much space will be consumed by a new snapshot (snapshots generally take a little less space than clish says they will).

[Expert@DallasSC]# clish -c "show snapshots" Restore points: --------------- AutoSnap_2025_04_30__08_00 AutoSnap_2025_05_01__08_00 AutoSnap_2025_05_02__08_00 Creation of an additional restore point will need 18.384G Amount of space available for restore points is 160.03G