Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 9670 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Interface tracking / reachablity check in HA

Emre Tayfur

Hello all,

 

I have 2 Sophos UTM 9 for redundancy. I configured them in HA. Now I would like to have interface tracking or reachibility check so that if one interface down, the othe pair should be Master. How can I manage to do it in configuration?

 

Thank you



This thread was automatically locked due to age.
Parents
  • 0

    Hi Emre,

    While configuring HA, you will get two options to select, 

    1. Select a preferred Master
    2. Select a backup interface

    Preferred master: Here you can define a designated master node by selecting a node from the drop-down list. In case of a failover, the selected node will not stay in Slave mode after the link recovers but instead will switch back to Master mode.

    Backup interface: To prevent that both master and slave become master at the same time (master-master situations), for example, because of a failure of the HA synchronization interface or an unplugged network cable, a backup heartbeat interface can be selected. This additional heartbeat interface can be any of the configured and active Ethernet interfaces (not Ethernet Bridge or Ethernet VLAN). If a backup interface is selected, an additional heartbeat signal is sent via this interface in one direction from the master to the slave to make sure that the master-slave configuration stays intact. If the master-slave connection is disabled and the backup interface becomes involved, the administrator will receive a notification informing that one of the cluster nodes is dead. However, this option is of no effect on slave systems, so you can leave it unconfigured.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Hi sachingurung,

     

    Thank you for your explanation. Probably I could clearly explain my problem because your explanation is not a solution for me.

     

    I have 2 Sophos and their both E0 ports are conencted to 2 swtiches (for example).

    Let's say 1st sophos is master. Meanwhile, if switch 1 is down, 1st sophos is still Master which I don't want. I want to track E0 so that when this port is down (or lost reachibility to switch 1), I want the other pair of Sophos bacame Master. 

     

    I hope it is better explanation.

     

    Thank you

Reply
  • 0 in reply to sachingurung

    Hi sachingurung,

     

    Thank you for your explanation. Probably I could clearly explain my problem because your explanation is not a solution for me.

     

    I have 2 Sophos and their both E0 ports are conencted to 2 swtiches (for example).

    Let's say 1st sophos is master. Meanwhile, if switch 1 is down, 1st sophos is still Master which I don't want. I want to track E0 so that when this port is down (or lost reachibility to switch 1), I want the other pair of Sophos bacame Master. 

     

    I hope it is better explanation.

     

    Thank you

Children
  • +1 in reply to Emre Tayfur

    In that case, go to Interfaces & Routing > Interface > Hardware > Eth0; select the HA Link Monitoring on the interface.  In case of a link failure, as stated by you, a takeover will be triggered. It is not recommended because it can cause unnecessary failures at the time. Also, if a configured interface is not always connected (e.g. management interface) please disable HA link monitoring for the corresponding interface. Otherwise all HA nodes will stay in status UNLINKED.

    Thanks

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

  • 0 in reply to sachingurung

    Thank you for your answer again. It was already enabled on all interfaces and it was leading the problem with HA status. After I disable HA link monitoring in unused ports, it seems it is working now.

Unfiltered HTML