topic Re: Switching a specific VS. in Firewall and Security Management

Switching a specific VS.

Matlu — Sat, 13 Sep 2025 17:46:50 GMT

Hello,
I have an MDS environment with VSX.
I have VSX clusters in VSLS mode, and I want to know if it is possible to switch only one specific VS.
For example, in a VSX cluster, I have approximately 10 VSs that have their VS standbys.
My VSX Node 1 is the one that currently has all VSs in ACTIVE mode, but I only want to “switch” the order of VS ID 3. Is this possible?
I want all other VSs to remain active on Node 1, but I only want to switch 1 of the VSs.
I have a CMA that manages this VSX box.
Thanks for your comments.

Re: Switching a specific VS.

the_rock — Sat, 13 Sep 2025 18:01:20 GMT

vsenv?

Re: Switching a specific VS.

JozkoMrkvicka — Sat, 13 Sep 2025 18:08:58 GMT

Since you mentioned you are using VSX with VSLS mode, you can perform failover on each VS, without impacting clusterXL state of other VSs.

Switch content on VSX Node 1 into VS ID 3 and perform failover. Failover will be done only on VS ID 3.

Before failover, make sure both members of VS ID 3 are in ACTIVE - STANDBY state.

To perform switch (failover) to only on VS ID 3 using clish (perform commands on VSX member where VS ID 3 is ACTIVE):

> set virtual-system 3

> set cluster member admin down

> set cluster member admin up

To perform switch (failover) to only on VS ID 3 using expert mode (perform commands on VSX member where VS ID 3 is ACTIVE):

# vsenv 3

# clusterXL_admin down

# clusterXL_admin up

Re: Switching a specific VS.

Matlu — Sat, 13 Sep 2025 18:08:43 GMT

Hello. @JozkoMrkvicka
This will only affect VS ID 3, correct?
Will the rest of the VSs retain their position, remaining “ACTIVE” on Node 1 and “STANDBY” on Node 2?
Thank you.

Re: Switching a specific VS.

JozkoMrkvicka — Sat, 13 Sep 2025 18:10:17 GMT

As far as you are really using VSLS mode of VSX, only VS ID 3 will be affected.

Re: Switching a specific VS.

Matlu — Sat, 13 Sep 2025 18:16:16 GMT

Yes, I am using this VSX Cluster mode.

[Expert@FWCP-01:0]# cphaprob state

Cluster Mode: Virtual System Load Sharing (Primary Up)

ID Unique Address Assigned Load State Name

1 (local) 10.0.0.25 100% ACTIVE FWCP-01
2 10.0.0.26 0% STANDBY FWCP-02

Active PNOTEs: None

Last member state change event:
Event Code: CLUS-114904
State change: ACTIVE(!) -> ACTIVE
Reason for state change: Reason for ACTIVE! alert has been resolved
Event time: Fri Sep 12 14:02:29 2025

Last cluster failover event:
Transition to new ACTIVE: Member 2 -> Member 1
Reason: Interface Mgmt is down (disconnected / link down)
Event time: Fri Sep 12 12:37:52 2025

Cluster failover count:
Failover counter: 1
Time of counter reset: Fri Sep 12 12:37:05 2025 (reboot)

Cluster name: FWCP-00

Virtual Devices Status on each Cluster Member
=============================================

Can I be certain that it will not affect other VSs according to my scenario?

Re: Switching a specific VS.

genisis__ — Sat, 13 Sep 2025 18:42:28 GMT

You should also be able to do this via vsx_util vsls command on the CLI of the MDS.

Re: Switching a specific VS.

the_rock — Sat, 13 Sep 2025 18:47:04 GMT

For what is worth, here is the AI response to it.

Andy

*****************

Yes — in a VSX cluster running in VSLS (Virtual System Load Sharing) mode, you can fail over (or “switch”) a single Virtual System (VS) to the standby member, without affecting the others.

Here’s how it works and what you can do:

✅ Behavior in VSLS

Each VS has its own Active/Standby state per cluster member.
Failover events are per VS, not necessarily cluster-wide (unlike traditional HA mode).
You can move just one VS to the other node while keeping the rest as-is.

🔹 How to switch one specific VS

You can use the ClusterXL commands with the -v option to target a specific VS:

Log into the VS context of the cluster member that currently owns the VS you want to move:

set virtual-system 3
Issue the failover command:

cphaprob fo

→ This forces the VS to fail over to its standby peer.

Alternatively, you can use the clusterXL_admin command directly on the VSX gateway in the context of that VS:

clusterXL_admin down -p <vsid>

Example for VS ID 3:

clusterXL_admin down -p 3

This will move only VSID 3 to the other cluster member.
Verify status:

cphaprob stat

🔹 Notes / Considerations

Other VSs will remain untouched and continue running on the same node.
If you use cphaprob fo without the -v or without entering a VS context, you risk failing over the entire cluster or all VSs.
Make sure that both members are fully synchronized before switching (check cphaprob stat or vsx stat).
This operation is commonly used for maintenance, balancing load, or troubleshooting.

✅ Answer: Yes, it’s possible. In VSLS mode, you can fail over just one VS (e.g., VSID 3) to the standby cluster member while keeping the rest on the current active node, using clusterXL_admin down -p 3 or by entering the VS context and running cphaprob fo.

Re: Switching a specific VS.

Chris_Atkinson — Sun, 14 Sep 2025 10:19:46 GMT

@Matlu is this a temporary change or do you want VS3 to prefer the other node on an ongoing basis?

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_VSX_AdminGuide/Content/Topics-VSXG/CLI/vsx_util-vsls.htm?Highlight=vsx_util

Re: Switching a specific VS.

Matlu — Sun, 14 Sep 2025 15:06:53 GMT

Hello,

This is a temporary change.

We just want to switch the original order of VS ID 3.
Cheers 🙂

Re: Switching a specific VS.

the_rock — Thu, 18 Sep 2025 01:51:37 GMT

Hey bro,

Were you able to get this sorted out?

Andy

topic Re: Switching a specific VS. in Firewall and Security Management

Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.

ChatGPT said:

✅ Behavior in VSLS

🔹 How to switch one specific VS

🔹 Notes / Considerations

Re: Switching a specific VS.

Re: Switching a specific VS.

Re: Switching a specific VS.