XG430 10G Flexi Port link not coming up - replacement of the module

The ethtool output: was this while it was already online again? 

BTW is your xmit Hash policy correct? Likely it does not match with your switch. 

yes. unfortunately I did not collect it while it was down.

LuCar Toni said:

The ethtool output: was this while it was already online again? 

will check about xmit policy on switch side.

the other HA node (primary) - that is running at a different location also has this issue with the blue LED.

3 out of 4 are lit on while on the auxiliary node are only 2 out of 4 lit on.

Primary: here PortA2 had it off while connected and running at full speed.

The following output is equal to the other node.

XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ethtool PortA1 | grep "10000"
        Supported link modes:   10000baseT/Full
        Advertised link modes:  10000baseT/Full
        Speed: 10000Mb/s
XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ethtool PortA2 | grep "10000"
        Supported link modes:   10000baseT/Full
        Advertised link modes:  10000baseT/Full
        Speed: 10000Mb/s
XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ethtool PortA3 | grep "10000"
        Supported link modes:   10000baseT/Full
        Advertised link modes:  10000baseT/Full
        Speed: 10000Mb/s
XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ethtool PortA4 | grep "10000"
        Supported link modes:   10000baseT/Full
        Advertised link modes:  10000baseT/Full
        Speed: 10000Mb/s

XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ethtool -i PortA2
driver: i40e
version: 2.10.19.82
firmware-version: 5.05 0x800028ac 0.0.0
expansion-rom-version:
bus-info: 0000:02:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

Hey LHerzog ,

Do you require a RMA for Sophos 4 port 10GbE SFP+ FleXi Port module right ?
The one which is mentioned here - https://www.connection.com/product/sophos-4-port-10gbe-sfp-flexi-port-module/sgiztchf4/41043540 | If yes could you please double check the serial no by Sophos mentioned in here - https://support.sophos.com/support/s/article/KB-000037169?language=en_US 

Yes, Vivek, they are SGIZTCHF4

I have posted a picture of the shipping boxes with SN to the case.

Hi LHerzog  Just saw that on the case, I'll expedite the process of RMA, Engineer will send a RMA form to you, please fill out the relevant details asked in the form.

Thank you very much!

You're welcome !

both RMA received. Can you provide documentation about the replace procedure and replacement order of the flexi modules on BOTH nodes in the HA-AP cluster? The case has been closed automatically and I cannot respond to it anymore.

Hey LHerzog the only available documentation we have is - https://docs.sophos.com/support/help/en-us/lifecycle/rma/index.html 

And for further quires you can always reach out to us or support !

Thanks. That does not help much unfortunately.

I only found this, but it is about installing a new module. I need to replace.

https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/HAConfiguration/HAFlexiModuleToHAAdd/index.html

The flexi ports are used by our LACP lag where all VLANs are configured.

I guess I need to open a new support case for that.

Oh you mean the procedure of installing the new 4Port/2Port module on Sophos appliance ?
Sure please, let me know the case id once raised !

Oh you mean the procedure of installing the new 4Port/2Port module on Sophos appliance ?
Sure please, let me know the case id once raised !

the case ID is 06434125 "Need procedure about how to replace Flexi Port Modules on both Firewall HA Members"

having some VLAN on the LAG that must "survive" the replacement.

XG430_WP02_SFOS 19.5.1 MR-1-Build278 HA-Primary# ls -l /sys/class/net/lag0* | wc -l
37

thanks for linking in, Vivek!

Thank you for the update, I'll check in with the team internally and will try to expedite your service request !

The flexi port module replacement process is currently undocumented at Sophos.

Yesterday we needed to shutdown the Auxiliary node due to power maintenance and I used that downtime to test the replacement of the card.

Luckily it works like plug and play. I replaced the flexi port module with one with the same PN and it was used for the existing LAG out of the box. All VLANs remained and no additional configuration was needed. I have not done the job on the primary node yet but expect it to work just as on the aux node.

Hey LHerzog , may be this can help clarify  "Installing a FleXi port module in HA."

the job was to replace it. that brings more questions than just adding it, due to existing config on it. That is the undocumented part.

I found, the new module has much more recent firmware. I supposed, the module is getting updatey by SFOS updates but it seems it isn't.

old, replaced module:

ethtool -i PortA4
driver: i40e
version: 2.10.19.82
firmware-version: 5.05 0x800028ac 0.0.0
expansion-rom-version:
bus-info: 0000:02:00.3
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

new module, received in RMA:

ethtool -i PortA4
driver: i40e
version: 2.10.19.82
firmware-version: 7.20 0x80007a01 0.0.0
expansion-rom-version:
bus-info: 0000:02:00.3
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

Btw, all blue speed LED are working again on the replacement module(s).

node1

node2

That is a great news, meanwhile I'll check if we any documentation internally !
Thank you for sharing your steps LHerzog  cheers !