GCP Cloudguard GW manual-failover

[AkosBakos]

Hi Mates,

I have some questions about HA failover in cloud.

Is there anybody here who is expert in GCP?

Akos

[Nir_Shamir]

Ask away 🙂 .

[AkosBakos]

Thanks, Great!

So I have a basic setup:

Interlnet -> HA cloudguard custer -> client inside.

I initiate a traffic eg. SSH sesion to the internet. If I do a clusterXL_admin down on the active member, the SSH disconnects.

It seems the connection does not sync to the standby member.

Are there any issues around this?

Akos

[Nir_Shamir]

Cluster HA in Google Works like a regular Cluster but there are external Google things you need to check before and after the failover.

first, on the Internal VPC the default route should point to the ACTIVE member. I guess that works otherwise you wouldn't have any connection.

When you failover, our GW sends an API call to Google Cloud which tells it to change the default route to the new ACTIVE member. 

So first check if this happens. Also check if on the External VPC subnet the "Private Google API access" is enabled.

[AkosBakos]

Yes, it is set.

[AkosBakos]

I attach a basic topology

[Rivka-Strilitz]

It sounds like you might be using the nic0 external IP for SSH. Could that be the case?
This is the  IP that gets switched between members during failover which is why the SSH connection gets lost.
Try connecting via SSH using NIC1 instead.

If that's not the case, then I think Nir's suggestion is a great place to start the investigation.

[AkosBakos]

It sounds like you might be using the nic0 external IP for SSH. Could that be the case?

No, because I NAT to the external IP of the loadbalancer in VPC

Akos