topic Down members of vsx but in state "standby" in Firewall and Security Management

Down members of vsx but in state "standby"

Stefano_Cappell — Fri, 11 Sep 2020 12:57:06 GMT

As it can be seen from the attached image, we have a vsx with 3 members, 1 active and the others in standby, But actually the two standby members are shown to be in "down" state.

what does it mean? which checks can we perform on the machines in order to be sure about their state and that they are actually ready for a failover event?

We need to get them ready for a jumbo hotfix, and it's pretty important that the redundancy works properly,

thanks

Re: Down members of vsx but in state "standby"

Bob_Zimmerman — Fri, 11 Sep 2020 14:21:05 GMT

You generally can't tell from a healthy member why another member believes it is unhealthy. What do you see on the other two members? 'cphaprob -i list' should tell you what problems a member believes it has locally.

Re: Down members of vsx but in state "standby"

Stefano_Cappell — Mon, 14 Sep 2020 10:24:08 GMT

thanks for the insight

This is the cphaprob state for the last member of the vsx, it also states that the redundancy state is DOWN.

"cphaprob -i list" instead seems to show no problem listed for the current module.

should it show to be in the state "standby"? is it safe to reboot the machine?

Re: Down members of vsx but in state "standby"

Sigbjorn — Mon, 14 Sep 2020 10:30:30 GMT

You need to switch to vsid 1 before running the command to see why that virtual system has problems.

vsenv 1
cphaprob -i list

I assume you've got VSX setup as a load sharing, so the vsx itself (vsid0) will always show standby, since they can run active virtual systems on all nodes.

Re: Down members of vsx but in state "standby"

Stefano_Cappell — Mon, 14 Sep 2020 12:39:16 GMT

yes

it actually says "current state: problem" now that I'm on vsenv 1

Re: Down members of vsx but in state "standby"

Bob_Zimmerman — Mon, 14 Sep 2020 13:39:53 GMT

Excellent! The members agreeing on their respective states means they are mostly communicating properly, and context 1 reporting a problem with the interface active check means the problem is only there. That rules out a lot of potential problems.

The next thing to check is 'cphaprob -a if'. At least one interface will be marked DOWN. Check that interface. Maybe the switch you're connected to isn't forwarding the VLAN how you expect.