Thread Info
  • State Suggested Answer
  • +9 person also asked this people also asked this
  • Locked Locked
  • Replies 35 replies
  • Answers 3 answers
  • Subscribers 21 subscribers
  • Views 146060 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Updating to 9.506 - Broke HA cluster

Anth

Hi all,

On Friday I patched our Sophos UTM cluster to 9.506 and found that the cluster is broken unless the passive node is switched off. The VM's are on the same ESX host and I have checked that they both have Virtual mac setting set to 0. Has anyone noticed this also and have a work around?

Cheers

Anthony 



This thread was automatically locked due to age.
Parents
  • 0

    As Patrick Weimer said interfaces on standby node mess with the vSwitch because of their identical runtime MAC addresses. On VMware, this results in VMs on the same physical host as the passive node being unable to contact the firewall, unless you shutdown this node. Using a different vSwitch between VMs and Sophos allows connectivity to the cluster again. We also raised a support request [#7866009] before finding this thread :) 

  • 0 in reply to Thomas Pirson

    Hi Thomas,

    Thomas Pirson said:

    As Patrick Weimer said interfaces on standby node mess with the vSwitch because of their identical runtime MAC addresses. On VMware, this results in VMs on the same physical host as the passive node being unable to contact the firewall, unless you shutdown this node. Using a different vSwitch between VMs and Sophos allows connectivity to the cluster again. We also raised a support request [#7866009] before finding this thread :) 

     

    Did you try  workaround on frankysweb blog?:

    https://community.sophos.com/products/xg-firewall/f/email-protection/94041/sophos-xg-dkim-and-dmarc-no-longer-supported/340573

     

    Look for comments section:

    BAlfson sagt:

    Sorry, my German-speaking brain isn’t creating thoughts at the moment.
    If anyone else has the same problem with VMs as Tom, please let us know if the following fixes your issue:
    How to resolve issues with Virtual UTMs configured for High Availability:
    1. Login to the UTM console as root.
    2. Enter the following command to determine if HA virtual_mac is enabled:
    cc get ha advanced virtual_mac
    3. If the output is 1, you can disable it by entering the following:
    cc set ha advanced virtual_mac 0
    4. Restart all virtual UTMs.
    Bitte auf Deutsch weiterhin.

     

    HTH

     

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

Reply
  • 0 in reply to Thomas Pirson

    Hi Thomas,

    Thomas Pirson said:

    As Patrick Weimer said interfaces on standby node mess with the vSwitch because of their identical runtime MAC addresses. On VMware, this results in VMs on the same physical host as the passive node being unable to contact the firewall, unless you shutdown this node. Using a different vSwitch between VMs and Sophos allows connectivity to the cluster again. We also raised a support request [#7866009] before finding this thread :) 

     

    Did you try  workaround on frankysweb blog?:

    https://community.sophos.com/products/xg-firewall/f/email-protection/94041/sophos-xg-dkim-and-dmarc-no-longer-supported/340573

     

    Look for comments section:

    BAlfson sagt:

    Sorry, my German-speaking brain isn’t creating thoughts at the moment.
    If anyone else has the same problem with VMs as Tom, please let us know if the following fixes your issue:
    How to resolve issues with Virtual UTMs configured for High Availability:
    1. Login to the UTM console as root.
    2. Enter the following command to determine if HA virtual_mac is enabled:
    cc get ha advanced virtual_mac
    3. If the output is 1, you can disable it by entering the following:
    cc set ha advanced virtual_mac 0
    4. Restart all virtual UTMs.
    Bitte auf Deutsch weiterhin.

     

    HTH

     

    -----

    Best regards
    Martin

    Sophos XGS 2100 @ Home | Sophos v20 Architect

Children
Unfiltered HTML