VRRP with R80.10 - Interfaces in backup mode

[Blason_R]

Hi Folks,

I am facing a weird issue with R80.10 Cluster in VRRP.

I have currently have only one firewall configured in VRRP cluster and management server is away one hop; that is on L3 switch. 

So my topology is INTERNET-----Firewall--> L3-->Mgmt server.

I then upgraded the firewall to R80.30 however after upgradation obviously it came up with Initial Policy since it could not fetch the policy from Mgmt server however when I decided to install policy it couldnt connect to Mgmt server. When I investigated I found that all the interfaces [though its single appliance in cluster] were in backup mode. And since no policy was installed HA module wasnt started.

I guess since being a single appliance it by default should come up as Primary, correct?

Any clue or any other alternative by which appliance can load last installed policy?

[Maarten_Sjouw]

If you look with cphaprob stat you will probably see it is in Raeady state, this means that when you have the flag MonitorFirewall set to ON it will not come up as master, so just change it to Monitor Firewall off.
set vrrp monitor-firewall off

[Blason_R]

I see does that mean since it does not have any policy it went in backup mode? And shutting down the monitor-firewall will make in Primary even if the policy is set as Initial?

[Maarten_Sjouw]

It checks the state of cphaprob, when it is still set to ready it will not go into Master mode.
As you only have one member ithis setting does not make sense to check. you always need to be in master mode with this member.

[Blason_R]

Oh ok - So, setting up firewall mode off makes sense, right?

[Maarten_Sjouw]

Yes, set vrrp monitor-firewall off makes sense.