topic Re: [VSX] How to disable an interface in HA monitoring in Firewall and Security Management

[VSX] How to disable an interface in HA monitoring

Franktum — Wed, 14 May 2025 10:30:07 GMT

Hi all,

In a regular cluster, when you want to failover when an interface goes down, you configure it as Cluster in Network Type field. Otherwise, you choose Private.

Don't know whether in VSX env, we could configure an interface not to be monitored by HA, hence a failover won't occur if that interface goes down.

Regards

Re: [VSX] How to disable an interface in HA monitoring

PhoneBoy — Wed, 14 May 2025 19:24:01 GMT

I believe you can add the interface to $FWDIR/conf/discntd.if and do a cprestart (both in the context of the relevant VS).

Re: [VSX] How to disable an interface in HA monitoring

emmap — Thu, 15 May 2025 02:59:20 GMT

Previously that would remove the IP from the interface on boot up, so I would avoid testing that in prod.

Private interfaces on SG clusters do not have VIPs, which is not an option on VSX. Essentially the IP you configure on the interface in SmartConsole is a VIP, so 'private' is not an option as you can't not have a VIP there on VSX.

What is the problem you are looking to solve by not monitoring the interface?

Re: [VSX] How to disable an interface in HA monitoring

Chris_Atkinson — Thu, 15 May 2025 05:41:15 GMT

What type of interface, a specific VLAN or something else?

Re: [VSX] How to disable an interface in HA monitoring

Franktum — Fri, 16 May 2025 09:16:15 GMT

Last week we got a non-critical interface (eth1-06) in a VS that was flapping constantly and, hence, so was the cluster. We wanted to exclude for HA monitoring that interface in order to avoid that scenario in the future.

Re: [VSX] How to disable an interface in HA monitoring

emmap — Mon, 19 May 2025 02:59:09 GMT

We don't really have an option to not monitor an access port on VSX. Ideally it would be best to understand why it was flapping and resolve that - if it's a barely used subnet, make sure there's always something in there with an IP address that will respond to ARPs and pings.