Turning down Vlan interfaces for specific instances (VSX R77.30 )

mph — Wed, 08 May 2019 23:37:57 GMT

I have a environment which has two data centers, in an active passive configuration.. Virtual Servers can be migrated from one site to the other. There is a requirement that the IP address's for servers dont' change if they are migrated.

At a network layer, this is a little problematic, as the vlan interfaces on the FW instances stay turn on, which means that the routing tables for the two datacenters both have routes for the local vlans. ( even though only one is actually 'alive'.

These firewall instances are set up across a cluster. What i'd like to do is set the state of the interfaces to off.

set interface eth9.99 state down

In theory this should remove the routes from the firewall, and it will stop redistributing them into OSPF.

Is there any issues with doing this, particually in a cluster? This can easily be automated as part of the DR 'failover'.
Right now there is some very complex Nat going on, and i'd like to clean it up. ( there is not ever a case where both locations need to be 'alive' at the same time.

TIA>

topic Turning down Vlan interfaces for specific instances (VSX R77.30 ) in General Topics

Turning down Vlan interfaces for specific instances (VSX R77.30 )