HA flop on manual firmware upgrade to 19.5

I met exaclty same issue last week. What's more interesting the auxiliary/passive appliance booted with non-active image 18.5.4.
Workaround was to disable the HA, upgrade the auxiliary appliance to 19.5.0 manually and setup the cluster out from the scratch.

Hello Marek,

Thank you for contacting the Sophos Community.

Did you, by any chance, create a Ticket for this? If so, do you mind sharing it?

I believe DEV might be interested in taking a look at your device, would it be possible to share via PM Access ID to your device?

Regards,

Hello Marek,

Thank you for contacting the Sophos Community.

Did you, by any chance, create a Ticket for this? If so, do you mind sharing it?

I believe DEV might be interested in taking a look at your device, would it be possible to share via PM Access ID to your device?

Regards,

Unfortunately appliances are not mine. I was just outsourced for pre-configuration and migration the config from single XG appliance and I don't have access to the cluster now. I'm more than sure Dev Team should be able to reproduce the problem with any two XGS 136 and they don't need the access to customer enviroment.

Hello David, Marek,

There is one suspected area noticed by dev team related to link flapping in XGS appliances.

Internal ticket is raised (NC-111325) and team is working on it.

Someone from engineering will contact you to help us verify the fix once it's ready.

Meanwhile, you can try this workaround for time being (not full proof but can help reduce the probability):

- Please disable the HA pair and upgrade both the appliances separately to 19.5 and enable HA again.

- As HA is sensitive to interface up/down event, I suggest to remove "monitoring links" from HA configuration.

- It will still have possibility of split-brain if dedicated link will up/down randomly. To minimize its probability, I would suggest to increase "keepalive interval" and "keepalive attempts" to MAX value (500ms and 24 respectively).

Regards,

Sanket Shah

Hello David,

We had this problem too while updating for a customer. From 6 updates (HA pairs), we had this problem 4 times.

I want to get updates from your internal ticket, thus I am writing here.

I have some more updates planned for Sunday. I will let you know how it went. 

We do not have at ticket at Sophos for the moment. 

Hello Facundo,

Could you please share the Case ID with us.

Regards,