topic Maestro redundancy testing in Hyperscale Firewall (Maestro)

Maestro redundancy testing

thaibinhn — Tue, 06 Apr 2021 06:59:55 GMT

Dear team,

Device’s list:

2 x MHO-140 R80.20SP
2 x SG7000 R80.30SP

Customer wishes to test Maestro redundancy, diagrams are attached

Downlink :

MHO-01 (1/55/1) <=> (ethsBP2-01) DC_GW01 (DAC)
MHO-01 (1/56/1) <=> (ethsBP2-01) DC_GW02 (LC-LC)
MHO-02 (2/55/1) <=> (ethsBP2-02) DC_GW01 (LC-LC)
MHO-02 (2/56/1) <=> (ethsBP2-02) DC_GW02 (DAC)

Case 1: Shutdown 1/56/1 and 2/55/1 => Lost the security group and lost connectivity (lost ping)

Case 2: Shutdown 1/55/1 and 2/56/1 => Lost the security group and lost connectivity (lost ping)

Case 3: Shutdown 1/55/1 or 1/56/1 => MHO-01 detach

Case 4: Shutdown 2/55/1 or 2/56/1 => MHO-02 detach

I get the result as above but it seems to be wrong.

As I understand MHOs are running Active/Active and we are in full mesh deployment, if 1 or 2 downlink go down, the other links should work properly and the Security Group should be up.

Might we have any explanation or document about Maestro redundancy?

Thank you very much,

Binh

Re: Maestro redundancy testing

Chris_Atkinson — Tue, 06 Apr 2021 08:25:58 GMT

Hi Binh,

For context can you please share the following additional information:

- VPC configuration
- Bond2 configuration
- R80.20SP JHF version used on the MHO-140
- R80.30SP JHF version used on the 7000

Re: Maestro redundancy testing

thaibinhn — Tue, 06 Apr 2021 09:58:38 GMT

Dear Chris,

vPC Configuration: LACP Active, with 4x40G physical links
Bond2: 802.3ad, with 4x40G physical links

MHO R80.20SP JHF 310
SGM R80.30SP JHF 47

Regards,

Binh.

Re: Maestro redundancy testing

Lari_Luoma — Mon, 17 May 2021 05:46:28 GMT

SGM need to have a connection to both MHOs in order for it to be considered UP. So if you have a single connection between each SGM and MHO and you cut one of them, the specific SGM will go DOWN. However, if you reboot the entire MHO, the connections are retained. Use dual-links between SGMs and MHOs if you want the SGM to stay up if one downlink is cut.