Sophos XG SF-OS Firmware Upgrade with Active/Passive HA - HA Broken after Firmware Update

Also, I know this ticks people off to hear it...but i never have this kind of issue with SG UTM 9.x appliances! :P

Can you share the output of these commands?

Hi bladefox3 

Please connect the device over the serial console to access- https://community.sophos.com/kb/en-us/123197

Sophos Firewall: Firmware updates in High Availability- https://community.sophos.com/kb/en-us/122816

Thanks Keyur,

Unfortunately the site is too far away for this option until i can schedule a visit out there.  Firmware Updates were done properly, i manage well over 100 XG and SG UTMS which didnt do this.

system ha show details

Result: HA is disabled

Advanced Shell commands dont show anything either (ran the same commands on both units)

As mentioned before, the firmware upgrade procedure disabled the HA during the firmware upgrade. the secondary unit also disabled HA, and unbound all interfaces but Port3/DMZ used for HA

The only reason i can connect to the UNIT2 is via Putty into UNIT1, then ssh admin@101.1.2 (UNIT2)

Thanks for your help.

Did you try to simply reboot the second apply one time? 

Seems like the other appliance is in some sort of strange condition therefor the HA broke. But actually its good, you have still access to the other appliance. 

Would suggest to reboot the other appliance one time, check which firmware applies. 

But if the command as suggested does not work, maybe the other appliance has some trouble with the firmware update. 

If you travel to the other site, pick up a Stick with you, prepared to reimage. https://community.sophos.com/kb/en-us/126906

Would be the fastes way to get back running, to simply reimage the second node and include it back to HA. 

So, the only real solution to this problem was drive to the site, take a monitor keyboard and mouse.  Connect directly to the XG and none of the documented "firmware" reloads worked, so the only option was to take this unit completely out of the ha, rebuild it from a factory default, manually clear the "corrupted" firmware using the shell, and then update to a newer firmware. Had to update the firmware on the main unit to that firmware as well which was a risk because if that had issues, then even more site problems.