topic Re: How to change the state of a cluster XL member using CLI commands in General Topics

How to change the state of a cluster XL member using CLI commands

SecdetKrypton — Mon, 05 May 2025 22:28:15 GMT

Hi team

I need to change the state of member 1 in the cluster from DOWN to STANDBY using CLI commands. Could you help me with the command?

This is the result of the command cphaprob state

ID Unique Address Assigned Load State Name

1 (local) 10.253.252.1 0% DOWN BOSQUES-FW01
2 10.253.252.2 1 100% ACTIVE(!) BOSQUES-FW02

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Mon, 05 May 2025 23:06:31 GMT

clusterXL_admin down; clusterXL admin up

Just run that from master member's ssh expert mode.

Andy

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Mon, 05 May 2025 23:08:03 GMT

Actually, scrap what I said, makes no sense to do my command, since one member is down anyway. PLease run below on both and send over.

Andy

cphaprob roles

cphaprob state

cpjaprob -i list

cphaprob -l list

cphaprob -a if

cphaprob syncstat

Re: How to change the state of a cluster XL member using CLI commands

SecdetKrypton — Tue, 06 May 2025 00:00:36 GMT

Thank you. I'm sharing the commands, and as additional information:

I'm sending the commands from FW1, which I can still access despite its Down state.

The firewall was forcibly set to Down state to redirect traffic through FW2 for testing purposes only. However, I now want to return it to Standby status."

BOSQUES-FW01> cphaprob roles

ID Role

1 (local) Non-Master
2 Master

BOSQUES-FW01> cphaprob state

Cluster Mode: High Availability (Active Up) with IGMP Membership

ID Unique Address Assigned Load State Name

1 (local) 10.253.252.1 0% DOWN BOSQUES-FW01
2 10.253.252.2 100% ACTIVE(!) BOSQUES-FW02

Active PNOTEs: FWD, LPRB

Last member state change event:
Event Code: CLUS-111205
State change: ACTIVE(!) -> DOWN
Reason for state change: FWD PNOTE
Event time: Wed Apr 30 21:22:26 2025

Last cluster failover event:
Transition to new ACTIVE: Member 1 -> Member 2
Reason: FWD PNOTE
Event time: Wed Apr 30 21:21:30 2025

Cluster failover count:
Failover counter: 22
Time of counter reset: Wed Mar 26 12:48:34 2025 (reboot)

BOSQUES-FW01> cpjaprob -i list
CLINFR0329 Invalid command:'cpjaprob -i list'.
BOSQUES-FW01> cphaprob -i list

Registered Devices:

Device Name: fwd
Registration number: 4
Timeout: 30 sec
Current state: problem
Time since last report: 7900.9 sec
Process Status: NOT UP

Device Name: Local Probing
Registration number: 7
Timeout: none
Current state: problem
Time since last report: 7877.7 sec

BOSQUES-FW01> cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 6
Required secured interfaces: 1

Interface Name: Status:

eth1 UP
eth5 (P) UP
eth2 UP
eth3 UP
eth4 UP
Sync (S) UP
Mgmt Non-Monitored

S - sync, HA/LS - bond type, LM - link monitor, P - probing

Virtual cluster interfaces: 5

eth1 X.X.X.X
eth5 10.X.X.X
eth2 X.X.X.X
eth3 10.X.X.X
eth4 10.X.X.X

BOSQUES-FW01> cphaprob syncstat

Delta Sync Statistics

Sync status: OK

Drops:
Lost updates................................. 0
Lost bulk update events...................... 0
Oversized updates not sent................... 0

Sync at risk:
Sent reject notifications.................... 0
Received reject notifications................ 0

Sent messages:
Total generated sync messages................ 49202273
Sent retransmission requests................. 0
Sent retransmission updates.................. 0
Peak fragments per update.................... 2

Received messages:
Total received updates....................... 10654913
Received retransmission requests............. 0

Sync Interface:
Name......................................... Sync
Link speed................................... 1000Mb/s
Rate......................................... 34060 [Bps]
Peak rate.................................... 1220 [KBps]
Link usage................................... 0%
Total........................................ 102493[MB]

Queue sizes (num of updates):
Sending queue size........................... 512
Receiving queue size......................... 256
Fragments queue size......................... 50

Timers:
Delta Sync interval (ms)..................... 100

Reset on Wed Apr 2 18:23:16 2025 (triggered by fullsync).

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Tue, 06 May 2025 00:04:01 GMT

K, never mind then, you can do clusterXL_admin up command on it.

Andy

Re: How to change the state of a cluster XL member using CLI commands

emmap — Tue, 06 May 2025 02:25:11 GMT

Not with FWD being down. I would suggest rebooting the gateway for a clean start and checking again.

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Tue, 06 May 2025 03:53:38 GMT

Now Im curious about fwd state, will test it in the lab tomorrow.

Andy

Re: How to change the state of a cluster XL member using CLI commands

AkosBakos — Tue, 06 May 2025 10:28:22 GMT

Right, the usually solve this. What is in the fwd.elg?

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Tue, 06 May 2025 11:54:19 GMT

As always, you were 100% correct! I tested in the lab, and fwd stays up when doing clusterXL_admin down, so reboot definitely sounds like a logical step.

Andy

Re: How to change the state of a cluster XL member using CLI commands

SecdetKrypton — Tue, 13 May 2025 01:34:32 GMT

Perform reboot, but only change state to secondary

ID Unique Address Assigned Load State Name

1 10.253.252.1 100% ACTIVE BOSQUES-FW01
2 (local) 10.253.252.2 0% DOWN BOSQUES-FW02

Re: How to change the state of a cluster XL member using CLI commands

the_rock — Tue, 13 May 2025 01:37:09 GMT

What does cphaprob -a if show now?

Andy

Re: How to change the state of a cluster XL member using CLI commands

Sorin_Gogean — Wed, 14 May 2025 08:55:52 GMT

Hello @SecdetKrypton ,

You've said that you forcibly set the FW01 to DOWN. What did you do actually ?

"The firewall was forcibly set to Down state to redirect traffic through FW2 for testing purposes only. However, I now want to return it to Standby status."

Also as we see, previously FW02 was the ACTIVE node and when you reloaded the FW01, that became ACTIVE and the other DOWN. That is weird for me, or you reloaded both of them ?
It can be that in the Cluster set-up, "Cluster-XL and VRRP", you have an option (in the lower part) "Maintain current active Cluster Member". We use that option, so it's not flapping/flipping over each time you reload a node/member.

when you failed to FW02

ID Unique Address Assigned Load State Name

1 (local) 10.253.252.1 0% DOWN BOSQUES-FW01
2 10.253.252.2 100% ACTIVE(!) BOSQUES-FW02

after you reloaded the box or both boxes ?!?!?!

ID Unique Address Assigned Load State Name

1 10.253.252.1 100% ACTIVE BOSQUES-FW01
2 (local) 10.253.252.2 0% DOWN BOSQUES-FW02

Ty,