topic Re: Disabling physical interfaces in VSX in Firewall and Security Management

Disabling physical interfaces in VSX

net-harry — Sun, 15 Dec 2019 17:52:30 GMT

Hi,

We have some physical interfaces on a VSX cluster that are no longer used. How do I disable them?

I noticed in sk92311 that "set interface INTERFACE_NAME state" is blocked in CLI. The sk says "Some settings on Security Gateway / Cluster in VSX mode should be configured only via the SmartDashboard (e.g., adding VLAN interfaces)". However, I am not able to find where to disable physical interfaces in the SmartConsole.

Thanks for your help!

Harry

Re: Disabling physical interfaces in VSX

Maarten_Sjouw — Sun, 15 Dec 2019 18:52:19 GMT

To issue any interface command once you have changed the box to VSX is only possible when you turn VSX "off" for a few moments to allow you to issue those commands.
So this is the way:
set vsx off
set interface eth3 state off
set interface eth4 state off
set vsx on
Done.
Actually all set vsx on does, it disables a number of commands and it show a page that the WebUI cannot be used when you try to.

Re: Disabling physical interfaces in VSX

net-harry — Sun, 15 Dec 2019 19:00:18 GMT

Thanks Maarten,
That worked very well!
Harry

Re: Disabling physical interfaces in VSX

Jake_Williams — Mon, 16 Dec 2019 17:07:19 GMT

Follow up question to your statement - does that mean if I run "set vsx off" in clish, I can do some things through the WebUI?

Re: Disabling physical interfaces in VSX

Maarten_Sjouw — Mon, 16 Dec 2019 17:21:39 GMT

I would not recommend it but yes that would be possible.

Re: Disabling physical interfaces in VSX

TheRealDiZ — Fri, 03 Apr 2020 13:16:16 GMT

Hi guys, @Maarten_Sjouw @net-harry @Jake_Williams

There is no other way to set a VSX interface off? Is there any official reference by CP?

Furthermore I have an issue on VSX where an interface that is not a cluster interface went down and so the Interface Active Check says "problem" .

The cluster member is in down state due to this interface that is set as "state on" at GaiaOS level.

I just want to disable it without issuing set vsx off.

What set vsx off will cause?

Also why the Interface Active Check is checking an interface that is not part of cluster monitored interfaces?

Any idea?

Thanks in advance

D!Z

Re: Disabling physical interfaces in VSX

Maarten_Sjouw — Fri, 03 Apr 2020 20:54:04 GMT

All that set vsx ON does:
it disables you from making changes to the interfaces
it disables the WebUI
So all set VSX off does is re-enable these two features.

That said, you should never leave vsx off on any VSX system when you made the required changes.