topic Re: VSX ClusterXL in Firewall and Security Management

VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 08:45:00 GMT

Hi Guys, not sure if this output is normal when dealing in active standby VSX.

when I do "cphaprob state" in the VS0 it shows that it is active standby. But, when I enter a specific VS such as VS1 then I do "cphaprob state" it shows that this VS is in active active in both VSX gateways.

is this the normal scenario? Is this means the both VAX gateways forwards traffic in that VS?

thank you.

Re: VSX ClusterXL

HeikoAnkenbrand — Tue, 14 Jul 2020 09:23:22 GMT

In VS0 you should always see the status of the VSX ClusterXL. For example the following is normal for VSX LS:
GW1: active GW2: standby GW3: standby

The virtual systems VS1, VS2,... can have different status informations.
For example:
VS on GW1: active
VS on GW2: standby (full session and tabel sync with the active VS gateway)
VS on GW3: backup (no session and tabel sync with the active VS gateway)

Here a list with cluster states:

Re: VSX ClusterXL

HeikoAnkenbrand — Tue, 14 Jul 2020 09:18:10 GMT

Here you find a cheat sheet with ClusterXL information:
R80.x - cheat sheet - ClusterXL

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 09:29:26 GMT

Hi @HeikoAnkenbrand , thanks for the feedback and help. But why mine is when I do cphaprob state in VS0 it shows that active/standby in each cluster members but when I go inside a specific VS then do cphaprob state, I can see active/active for both cluster members.

What is the meaning of it? Thanks

Re: VSX ClusterXL

Magnus-Holmberg — Tue, 14 Jul 2020 09:40:20 GMT

Am running some VSX in HA and all of the members are active/standby same with the VS atleast for R80.10 and up.
Same with VR that are active/standby, VSW complains if you do that command.

In VSLS it should show active / standby on all members when everything is OK.
The active will be on diff member depending what vs you check for.

Regards
Magnus

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 09:42:24 GMT

Hi @Magnus-Holmberg , which means my current status right now is abnormal. Is the Monitoring blade needs to be enabled for the clusterXL monitoring that will help for this? thanks

Re: VSX ClusterXL

Magnus-Holmberg — Tue, 14 Jul 2020 09:48:22 GMT

For HA the standard should be Active / Standby.
If there is something else there is an issue.

@HeikoAnkenbrand did post a list of all statuses 🙂

Regards
Magnus

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 10:02:49 GMT

Hi @Magnus-Holmberg , yup I saw @HeikoAnkenbrand's posts. Do you have any idea why my VS goes active/active in both cluster members? Thanks

Re: VSX ClusterXL

_Val_ — Tue, 14 Jul 2020 12:36:38 GMT

If you are running a bridge mode, it will be shown active-active, as it is supposed to be.

Please share with us your "cphaprob stat" from VS0 and also "vsx stat -v" output, then we can be sure what's going on

Re: VSX ClusterXL

HeikoAnkenbrand — Tue, 14 Jul 2020 12:54:54 GMT

Hi @CyberBreaker,

I agree with @_Val_.

In which mode do you use the VS?
- Bride mode a/a (I think active/active)
- Bridge mode a/s

In the virtual system general properties page of the virtual system object, you can see the selected mode! Maybe a screenshot of this as well.

Can you send a screenshot of "cphaprob stat" in "vsenv 0"

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 12:54:02 GMT

Hi @_Val_ @HeikoAnkenbrand , sorry I forgot to include it in my first statement. Yes, my VSX' are running in bridge mode.

The cphaprob stat in VS0 states that FW1 is Active and FW2 is Standby. The cphaprob in VS1 and VS2 states that both FW1 and FW2 are Active.

So meaning, this scenario is normal?

Thanks

Re: VSX ClusterXL

_Val_ — Tue, 14 Jul 2020 12:55:20 GMT

yes, it is normal

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 12:56:13 GMT

Hi @_Val_ , thanks for the confirmation 😁.

Re: VSX ClusterXL

HeikoAnkenbrand — Tue, 14 Jul 2020 12:57:20 GMT

@_Val_ was two seconds faster.
Yes, that's normal.

Re: VSX ClusterXL

CyberBreaker — Tue, 14 Jul 2020 12:58:27 GMT

Thanks also @HeikoAnkenbrand for the help 😁

Re: VSX ClusterXL

_Val_ — Tue, 14 Jul 2020 14:46:10 GMT

lol, there is no competition here 🙂

Re: VSX ClusterXL

CyberBreaker — Fri, 17 Jul 2020 15:37:07 GMT

Hi @_Val_ just a follow up question. Even if the VS shows active/active, it will still follow the cluster role which is active/standby state, correct? So if I failover, the VS will now pass traffic to the new active VSX gateway, correct?

Re: VSX ClusterXL

_Val_ — Fri, 17 Jul 2020 20:27:53 GMT

The state is per VS. If a VS fails over, then yes, traffic will be handled as you say