topic Re: Remove interface from VSX systems. in Firewall and Security Management

Remove interface from VSX systems.

Christian_Koehl — Tue, 15 Oct 2019 13:24:03 GMT

Dear CheckMates,

I have running a VSX Cluster with VSLS with some bond interfaces in version R80.20. A couple of VLANs were added to bond1 and in each of my VS systems one of this bond1 VLAN interfaces is used.

Now, the bond1 needs to be remove.
Therefore, I have deleted the bond1 VLAN interface in every VS and installed the policy within that VS.

A "show configuration" still shows the configuration for all the bond1 VLAN interfaces.
"vsx_utill show_interfaces" did't show them.

How to remove the configuration for the bond1 interface completly?

Best regards,
Christian

Re: Remove interface from VSX systems.

Maarten_Sjouw — Tue, 15 Oct 2019 13:42:18 GMT

Did you push the policy after you removed the VLAN interfaces? It really sounds like you did not.

Re: Remove interface from VSX systems.

mdjmcnally — Tue, 15 Oct 2019 14:25:33 GMT

Did you select to remove Bond1 from Physical Interfaces on the actual VSX Cluster Object and then install the Policy to the VSX Cluster itself.

I believe that afterwards will have to SSH to the box

set vsx off

delete bonding group bond1

set vsx on

Make Sure install policies afterwards

Should remove the bond1 from the VSX Cluster and then remove the bond from the VSX box.

Re: Remove interface from VSX systems.

Christian_Koehl — Tue, 15 Oct 2019 17:36:42 GMT

I have installed the policy. It tooks me some time, as I have done this in about 9 different Domains / for 9 different gateways....

This steps, as requested, I will do the next time, when I am at the customer.

   set vsx off
   delete bonding group bond1
   set vsx on

Thanks to all for your help,

Christian

Re: Remove interface from VSX systems.

Christian_Koehl — Mon, 04 Nov 2019 09:14:50 GMT

Hi folks,

Sorry for not updating this post earlier.

I run the command "set vsx off" and tried to delete the bond, but it still fails with the error-message "This interface is used by the Dynamic Routing Protocol: Static Routes. Cannot delete the selected interface."

Any ideas?

Best regards,

Christian

Re: Remove interface from VSX systems.

Maarten_Sjouw — Mon, 04 Nov 2019 09:43:05 GMT

you need to remove any IP if still there on the interface.

Re: Remove interface from VSX systems.

Christian_Koehl — Mon, 04 Nov 2019 10:14:53 GMT

Hi Maarten,

in the screenshot you can see in the background, the IP for bond1.4031 is deleted, but I still can't delete the VLAN interface itself.

Best regards,

Christian

Re: Remove interface from VSX systems.

Hugo_vd_Kooij — Mon, 04 Nov 2019 11:34:32 GMT

Check your config very carefully.

I would use at least:

clish -c "show configuration" | grep bond

It might show you some leftovers you need to take care of.

Re: Remove interface from VSX systems.

mdjmcnally — Mon, 04 Nov 2019 11:53:29 GMT

How are you trying to delete the vlan interface?

I ask as the WebUI which I am guessing is being run AFTER running the set vsx off as VSX doesn't have the WebUI enabled is showing interfaces with IP from the VSX Network.

You won't be able to delete the bond1 until all of those sub-interfaces are removed.

I would expect that they are deleted in the SmartConsole for the VS that they are created in and then after the topology updates then says to install the security policy.

You said that did this but is contradicted by seeing the vlan interfaces exist in the WebUI which to access would need to have the VSX turned off.

Re: Remove interface from VSX systems.

Maarten_Sjouw — Mon, 04 Nov 2019 12:05:10 GMT

Are you trying to remove the BOND interface or only a VLAN?
You will not be able to see all information from VSX in the GUI.
As Hugo says get the info from the Show configuration to see what is going on.

Re: Remove interface from VSX systems.

Daniel_Taney — Mon, 04 Nov 2019 20:24:01 GMT

Did you also remove the bond interface from the Physical Interfaces tab of the VSX Cluster Properties? If there are no VLANs left on this bond group, you don't want it listed here.

Re: Remove interface from VSX systems.

Maarten_Sjouw — Tue, 05 Nov 2019 07:22:47 GMT

On second thoughts The only way to remove a VLAN interface on a VSX system is by deleting that interface from the VS it is used in.
Only when you have removed all VLAN's from the Bond interface, will you be able to remove the interface itself.

Re: Remove interface from VSX systems.

Luis_Romero — Wed, 02 Jun 2021 20:17:34 GMT

I get the same error when deleting the vlan by webui and cli, did they manage to fix it?