HA cluster update failed - One node is in DEAD status

Question

Hi, 
 
 After I've tried to update the UTM HA Cluster from 9.702-1 to 9.703-3 one node is in DEAD Status. (both models are SG230) 
 I've already re-image it with version 9.607-2 and now I have one node with 9.702-1 and another node with 9.607-2 and I'm trying to re-create the HA cluster. 
 I know one of the requests to create an HA cluster is to have the same version. But the version 9.702-1 is not available for download. 
 What is the best practice in this case? Can I manually download the u2d file 9.702-1 and manually update the second node from 9.607-2 to 9.702-1? And re-create the cluster after that 
 Why is no way to update the second node to the same version as the primary node during the HA creating procedure? Ore maybe is it? 
 
 Thank you

BAlfson · Accepted Answer

Salut Adrian, 
 Like Harsh says, you need to apply all of the Up2Dates in order. 
 Here are the instructions I supply to customers when they replace one of their nodes: 
 1. If needed, do a quick, temporary install so that the new device can download Up2Dates. 2. Apply the Up2Dates to the same version as the current unit, do a factory reset and shutdown. 3. On the current UTM in use, on the 'Configuration' tab of 'High Availability': a. Disable and then enable Hot-Standby b. Select eth3 as the Sync NIC c. Configure it as Node_1 d. Enter an encryption key (I've never found a need to remember it) e. Select 'Enable automatic configuration of new devices' f. I prefer to use 'Preferred Master: None' and 'Backup interface: Internal' 4. Cable eth3 to eth3 on the new device. 5. Cable all of the other NICs exactly as they are on the original UTM. 6. Power up the new device and wait for the good news. 
 Problem is, I don't see that there is any other Up2Date left for 9.607 other than the one to 9.705, which is the version I recommend to my clients. I would allow the running machine to Up2Date to 9.705 and apply the 9.607-9.705 Up2Date to the unit with 9.607. 
 Cheers - Bob

Adrian Poeana · Answer

Hi, 
 I had to update the primary node to the latest version 9.705. Re-image secondary node with the same version and rebuilt HA. 
 Up and running both on HA cluster

FormerMember · Answer

Hi Adrian Poeana , 
 Thanks for reaching out, and welcome to the Community! 
 Check out the following KBA to update the firmware from 9.607-2 to 9.702-1. You would have to download each firmware package from 9.607-2 to 9.702-1 and install each of them one by one. 
 
 Sophos UTM: Manual firmware installation with Up2Date 
 Index of /pub/UTM/v9/up2date/ 
 
 Once both firewalls are on the same firmware version, you could re-configure HA. 
 Thanks,

FormerMember · Answer

Hi Adrian Poeana , 
 Yes, the firmware package above the previous screenshot is the one you're looking for. 
 Reference screenshot: 
 
 Thanks,

HA cluster update failed - One node is in DEAD status

Top Replies