Downtime during HA Active-Passive setup

Question

Hello, 
 I took over a sophos installation from a previous admin and the way they set it up is bit problematic. We have two UTM SG230 appliances, but one is always kept as offline spare. This makes updates always a pain, especially since we can not be down for any period of time. 
 Because of that I want to add the secondary UTM as Failover Host. What I absolutely cannot do is bring the network down with it. 
 So can I add a Failover Partner without a downtime on the current master? 
 What steps would you suggest I take in what order to get this running as smooth as possible?

Keyur · Answer

Hi Christopher Perrin

I have confirmed with my team and found out that you can configure HA without nay downtime, please configure the Slave device as per required HA configuration and verify Master device HA configuration, put the slave device into the network, make connection and enable HA from Master device and it will up without any downtime for master device.

DouglasFoster · Answer

I just switched from single-device to HA. As far as I could tell, all I lost was one ping packet while switching cables. 
 Before 
 inside switch - UTM1 - Outside router 
 After 
 Inside switch - UTM1 - Outside switch/Private_VLAN \__ Outside router Inside switch - UTM2 - Outside switch/Private_VLAN / 
 New unit - Offline 
 
 I already had a CD of my running firmware. Installed the new UTM using that CD to have matching versions. 
 Copied the config file from the running machine to the new unit to have matching configurations. 
 Configured HA Autoconfigure using port E4 
 Racked the new unit. 
 With unit powered off, connect network cables. 
 
 Outside switch 
 
 Prepared VLAN with 4 ports UTM1, UTM2, Router, spare port for future monitoring. 
 
 Old unit - Onlne 
 
 Configure HA Autoconfigure using port E4 
 Swap cable to use Private VLAN instead of direct-connect. 
 Verify normal traffic using old unit. 
 Boot new unit 
 Watch the HA live log as the new unit boots. 
 
 Synchronization took about 5 minutes. 
 Previously, I had configured a spare interface for emergency-access using a direct-connected laptop. This caused both units to show status "Unlinked", but the old unit remained as Master. HA considers a network problem to be occurring if any enabled interfaces are down. So I disabled the unused interface, another Slave Sync occurred, and then the unit went into Active-Standby mode as desired. 
 
 Good luck!