Shutdown one unit in HA setup

Hi Karsten,

your steps are correct so far.

For step one just go to the appliance and use the front panel to shutdown the device. This also applies to step 5.

Here you just power off the MASTER device after the sync is successful.

Best Regards
DKKDG

Your stepa are ok.

Within webadmin goto "management / high availability".

here you see booth nodes.

click shutdown to slave first.

after slave is online again (no longer syncing = state "ready") you can shutdown the master from here too.

The slave becomes your new master.

Or use the frontpannel as explained already.

Hej Karsten and welcome to the UTM Community!

I would not do it like that.  My recommendation is:

1. shutdown (power off) the SLAVE unit
2. physically move SLAVE unit
3. reconnect all cables to SLAVE unit and power it back on
4. wait for sync
5. shutdown (power off) the current MASTER (the unit not yet moved) and the unit already moved will become MASTER
6. repeat steps 1-3 for new SLAVE unit

Cheers - Bob

Thank you dirkkotte - for the detailed steps. Exactly what I needed! ;o)

Kind regards

K. Stolten

Hi Bob,

I'm in a similar situation to the above but we're moving to a new datacentre and have a pair of SG450s (UTM 9.605-1) running in an Active-Passive HA configuration that we need to move.

The new datacenter will use the same IP subnets (internal and external) as the old datacentre. Ideally rather than moving both UTMs in one go we would like to do a test of the new datacentre by moving just one of the UTMs over first, then briefly switch the routing of the internal and external IPs to the new datacentre to ensure everything works okay prior to the final cutover. My question is, is this possible? I'm not clear how this is best achieved (if actually possible). Here would be what I would hope to be able to do:

1. Shutdown UTM2 (currently Slave), leaving UTM1 running (currently Master) in old datacentre..

2. Move UTM2 to the new datacentre (not currently connected to any network), cable it up (all IPs and subnets are identical), then power it up.

3. When ready to do our test run we will disconnect the old datacentre from the network, connect the new datacentre to the network, and then route the internal and external traffic to the new datacentre.

4. Check that all expected connectivity in the new datacentre is working as it was in the old datacentre.

5. Once testing is completed, disconnect the new datacentre from the network, reconnect the old datacentre and switch the routing back to the old datacentre. Leaving UTM2 in the new datacentre.

6. When ready to do the final cutover to the new datacentre, power down UTM1, move to new datacenter and cable back up including reconnecting HA cable.

7. Power up UTM1 and let the UTMs sync.

8. Disconnect old datacentre. Switch all routing to new datacentre.

Does this sound feasible? UTM1 and UTM2 while in separate datacentre will not have any HA connectivity as only one datacentre will ever be live on the network at any one point. I guess the questions are:

- Would UTM2 on being powered back up in the new datacentre switch to being a Master as it would no longer have UTM1 connected?

- Would UTM2 go back to being a slave when UTM1 was moved over to the new datacentre and reconnected exactly as the UTMs were in the old datacentre?

Being able to test the new datacentre would help de-risk the migration as we don't want to find out there are problems on the final cutover when we bring all the servers over from the old datacentre. Any advice or comments would be gratefully received.

Thanks,

Colin

If you separate the cluster nodes, this will result in 2 Master-nodes.
If you join the node from old DC to running master within new DC, this node become slave and syncprocess writes data from new DC-node to this node.
You will lose data/logfiles from old DC.  
But this should work.

Thanks Dirk, that's great.

So UTM2 will declare itself the Master when UTM1 comes over to join it even though they will still both be Masters?

If two SG's getting together after booth are master, the device with most uptime is the new master.

I recommend to build HA connection and then start the second device.

Agreed with Dirk that this should work, Colin.  Just out of an abundance of caution I would probably disable/enable all Interfaces after powering the UTM up in the new DC - I'm not sure what will happen due to the different MAC addresses in the new DC.  Then when bringing the second UTM to the new DC, I would, again, out of an abundance of caution, do a factory reset of that device and power it down before connecting all of the cables.

Please let us know your results!

Cheers - Bob

Hi @all,

we are Planning to Upgrade our HA Cluster.

We are running two Sophos SG 310 in a HA Cluster and want to Upgrade to two Sophos SG450. Can we do it also like Karsten it described:

1. shutdown (power off) the SLAVE unit (how?)
2. change SLAVE unit to the new one?
3. reconnect all cables to SLAVE unit and power it back on
4. wait for sync
5. make SLAVE unit MASTER (how?)
6. repeat steps 1-3 for new SLAVE unit

Best Regards

Manuel