topic Re: Maestro Reboot Derby in Hyperscale Firewall (Maestro)

Maestro Reboot Derby

Lloyd_Braun — Tue, 09 May 2023 15:55:57 GMT

I'm curious as to how long it generally takes for a SGM to rejoin a security group. After a reboot, I am seeing it take a solid 17 minutes of uptime before a 16200 shows up as 'ACTIVE' in asg monitor. Most of this time seems to be 'Fullsync' pnote getting to a healthy status.

Environment:

R81.10 Take 81

8 node cluster split between two MHO-140s (4 active / 4 standby)

2.4 M concurrent connections

I think this is faster during off-hours when there are less concurrent connections/new connections per second, but not 100% on that.

Re: Maestro Reboot Derby

Wolfgang — Tue, 09 May 2023 20:04:09 GMT

@Lloyd_Braun yes, we see the same time to join a security group. With Maestro you have to wait a lot of time if you are doing operations like join or move SGM from and to security groups.
Another question… you wrote (4 active / 4 standby) do you run a dual site environment ?

Re: Maestro Reboot Derby

Lloyd_Braun — Tue, 09 May 2023 20:44:07 GMT

Yes, dual site. Technically, the SGMs show active/active per 'cphaprob stat' with MHOs in active/standby mode.

Re: Maestro Reboot Derby

Dario_Perez — Tue, 09 May 2023 22:26:30 GMT

the way to monitor is asg monitor to see which chassis is active and which is stanby

Re: Maestro Reboot Derby

emmap — Wed, 10 May 2023 02:02:23 GMT

The short answer is 'it depends'. Basically, how busy is the environment, do you have auto-clone enabled, what JHF is on there (there are some little improvements in newer takes), all that. We are working on improving the speed of auto-clone in future versions.

Re: Maestro Reboot Derby

Lloyd_Braun — Fri, 28 Jul 2023 14:45:16 GMT

Looks like there is a fix to improve fullsync time after reboot in r81.20 Take 14: PRJ-45072,
PMTR-89908

Not seeing it mentioned it r81.10 JHF release notes