topic Re: smo priority in Hyperscale Firewall (Maestro)

smo priority

wsitu — Tue, 08 Apr 2025 04:28:41 GMT

r81.20 dual orchestrators with 4 SGM

i understand by default the SGM with the lowest id would be smo master. is it possible to change it such that another SGM take over as smo master?

Re: smo priority

Nir_Shamir — Tue, 08 Apr 2025 05:48:13 GMT

the only option is to stop the current SMO so another SGM will take its place using cpstop / clusterXL_admin down / shutdown

Re: smo priority

emmap — Tue, 08 Apr 2025 06:40:17 GMT

Yea the SMO master is always the SGM with the lowest ID that is active, so it should ideally always be SGM 1 (on the active site in a dual-site security group). If SGM1 is rebooted, SGM2 takes over the SMO role. When SGM1 is finished booting and returns back into the security group as an Active member, it's back once again as the SMO master.

Re: smo priority

wsitu — Tue, 08 Apr 2025 16:04:51 GMT

I encountered a major problem recently with jumbo update. at the time only 3 SGMs were functional. the bad one was removed from the SG. I patched SGM 1_2-1_3. asg_monitor show all 3 were Active before I proceed to update smo master. upon reboot of 1_1, the SG was completely down. I dont know if I will ever run into this situation again. it would be nice if i could promote 1_2 to smo permanently after it was patched before i tackle 1_1.

my SR is still under investigation. TAC believes I ran into a problem as mentioned in sk183181.

for future jumbo patching, what can you recommend so I dont run into this problem?

Re: smo priority

emmap — Wed, 09 Apr 2025 01:58:05 GMT

It depends on what the issue was but changing the SMO master role is unlikely to have resolved the issue. If all the SGMs were down, there was no SMO available.