Something wrong in "rollback to previous firmware version in HA" KB131848

Hi,

this Admin Access IP should be accessible.

https://community.sophos.com/kb/en-us/123174

• Peer Administration IP: This IP address must be on a different network than the Peer HA Link IPv4 of this device. The Admin Console of the Auxiliary Device can be accessed at this address. Any user accessing the Admin Console of Auxiliary Device will be logged in with the HA Profile and have read-only rights.

Cheers

I know that.

But all of my customer's HA sites can not access the peer admin IP after HA finished actually. 

Hi,

so you get a timeout on the Administration IP? 

What happen, if you break the HA? The Appliance should be still accessible via this IP. 

Break HA?

Are you kidding me?

They are on service...

If you break the HA, the Aux appliance will turn of all interfaces except 2: Admin interface and HA link. To recover the HA. 

But wanted to ask, if you already tried it. 

It mentions the following on KB.

When operating in HA, the graphical user interface (GUI) of the Auxiliary XG Firewall is accessible via the Peer Administration IPconfigured in the Primary XG Firewall.

When finished HA, the peer admin IP can't be accessed on my site.

If I break HA, the peer admin IP can be accessed without any problem.

Let me ask you a question, when finished HA, can you access peer admin IP?

It mentions the following on KB.

When operating in HA, the graphical user interface (GUI) of the Auxiliary XG Firewall is accessible via the Peer Administration IPconfigured in the Primary XG Firewall.

When finished HA, the peer admin IP can't be accessed on my site.

If I break HA, the peer admin IP can be accessed without any problem.

Let me ask you a question, when finished HA, can you access peer admin IP?

I can access in both scenarios the HA Admin IP.

Tested it with 3 HA Appliances. 

But - to be honest - i cannot nat the HA Admin IP through the primary appliance.