topic Re: ElasticXL Policy Push Debug? in Hyperscale Firewall (Maestro)

ElasticXL Policy Push Debug?

Bob_Zimmerman — Mon, 27 Jan 2025 21:33:16 GMT

I'm trying out ElasticXL in a lab. I can't seem to push policy to one of my clusters (currently with one site and one member). The policy push debug script in sk159452 shows all clear on the management, and the files appear to make it into $FWDIR/state/__tmp/FW1/. When I run the script on the firewall side, it successfully loads the policy. When I push with the policy loaded, it still fails. When I reboot the member, it goes back to InitialPolicy.

I get the same results when I add a second member, which seems expected if pushing to a single member fails. I've tried with the 15-day PnP eval, a manually-generated 30-day eval, and a real, permanent license with the same results in all those cases.

These are lab boxes, so I can rebuild and try anything at any time. What I can't do is call support, since the lab management wasn't part of our most recent renewal, and the firewalls aren't supported with ElasticXL.

Any advice on what I should look at or try?

Re: ElasticXL Policy Push Debug?

the_rock — Mon, 27 Jan 2025 23:07:09 GMT

What is the error you get? Does it complain about the licence?

Andy

Re: ElasticXL Policy Push Debug?

Bob_Zimmerman — Tue, 28 Jan 2025 01:16:08 GMT

I guess I should have mentioned, but it's one of the most unhelpful error messages in the history of error messages:

Installation failed. Reason: Failed to load Policy on Security Gateway.

That is the full extent of what it tells me in the task.

I also just discovered that while the member accepts the permanent license (and is even able to fetch the associated contracts), it removes it after a few minutes. I decided to try switching the sixth interface back from the name "eth-01" (which is included in magg1 by default) to the name Mgmt. Rebooted, ran this in gclish via serial console:

add bonding group 1 interface Mgmt

and presto. My license stopped getting removed, and now policy installation works. Weird, but I'll take it.

Re: ElasticXL Policy Push Debug?

the_rock — Tue, 28 Jan 2025 01:20:23 GMT

I recall that message a lot back in R76 and R77 versions. Anyway, glad you got it working.

Andy