topic Re: Enable ipv6 on Maestro in Hyperscale Firewall (Maestro)

Enable ipv6 on Maestro

thanhnguyen — Thu, 12 Sep 2024 07:00:55 GMT

How to enable IPV6 on Mastro without reboot all device.

Re: Enable ipv6 on Maestro

_Val_ — Thu, 12 Sep 2024 07:01:50 GMT

I don't think it is possible. You need to load IPv6 stack, which can only be done upon reboot.

Re: Enable ipv6 on Maestro

thanhnguyen — Thu, 12 Sep 2024 07:08:27 GMT

I can reboot -b < member> instead of reboot -b all, when i enable ipv6 with set ipv6-state on (global mode), does it work

Re: Enable ipv6 on Maestro

emmap — Thu, 12 Sep 2024 07:48:59 GMT

Colleagues have stated that not rebooting them all at once causes problems, so you should do them all at once.

Re: Enable ipv6 on Maestro

thanhnguyen — Thu, 12 Sep 2024 09:24:55 GMT

To minimize downtime, can I reboot each member and then isolate it to transfer traffic when enabling ipv6 on node 1 while in init state?

Re: Enable ipv6 on Maestro

Pauli — Thu, 12 Sep 2024 11:53:21 GMT

yes, the entire cluster has to be rebooted at once. Unfortunately, the reboot per member does not work because the different configuration is overwritten again at the latest during the SMO reboot.

So I don't understand why IPv6 is not activated by default and I switch it off when necessary....

In production, this always means an interruption. And this is difficult to understand in a redundant environment...
Or does the option have to be built in to switch IPv6 on separately for each SGM....

Re: Enable ipv6 on Maestro

emmap — Fri, 13 Sep 2024 02:47:46 GMT

I don't really understand how you'd do that, and it's not tested or documented procedure so it wouldn't be a supported method.

Re: Enable ipv6 on Maestro

thanhnguyen — Fri, 13 Sep 2024 02:53:19 GMT

enable ipv6 node 2
=> status node 1 : active
status node 2 : init (when reboot)

=> shut down node 1 change traffic node 2

=> enable ipv6 node 1 => sync traffic node 1 2

Because, i want to minimize downtime.

Sorry, My English is not good

Re: Enable ipv6 on Maestro

emmap — Fri, 13 Sep 2024 03:15:02 GMT

While an SGM is INIT'ing, it is sync'ing configuration and such from the active SGM. Hence it can sync configuration that disables IPv6 and cause issues for you. We would not recommend this approach due to unknown issues it could cause.