Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problems with RMA-replaced UTM in HA

Backstory: In our remote office, one of two SG310 appliances had broken down (probably for electrical reasons) and would not boot back into the HA cluster.

Thanks to Sophos support, we tried to boot teh firmware from a USB stick, which at least looked like a complete boot according to the LCD display, but we still did not get HA back: The dead node was previously deleted from the master and master was configured to auto-detect new devices, so the freshly installed node should have been detected and brought into HA. As this did not happen, we initiated a replacement through support.

Today, the replacement arrived, we hooked it up and waited - but again nothing happened. After some hours, we went through the display and made a factory reset - no change. Before bothering support once again, I'd like to know if someone here has expereinced someting like this. I feel like we somehow overlooked something totally stupid.

What we do observe (by flipping through the LCD display):

  • Firmware version is 9.705, as is master
  • HA Config is set to "Not a HA device" and apparently this cannot be changed. Not sure if this is expected in this state and would change only after a successful sync.
  • eth0 seems to be set to 192.168.0.1/24 as expected for a new device. However, I cannot ping this address (from a Windows PC configued with an 192.168.0.x address - our standard LAN is in the 10.*.*.* range). It does not even do ARP resolution!
  • The LAN switch sees practically no traffic on the port connected to eth0. It did not even learn a MAC address for that port


This thread was automatically locked due to age.
Parents Reply Children
  • Nothing special about the switch port (and it's the same port used with the former defective appliance). May try Notebook directly (is crossover needed?)

    HA is via eth3 (with eth0 as backup). On master, highavailabilty log also shows "Netlink: Found link beat on eth3 again!" (but also "Monitoring interfaces for link beat: eth1 eth0")

    A tcpdump on eth0 shows only lots of multicasts to udp ports 695, 3780, 501, but nothing coming back ... Maybe I'll try to replace the eth3-eth3 cable

  • you don't need a crossover cable ... but may use one.

  • Ok, I meanwhile figured that out as well from the initial config guide.

    Unplugging and repluging the eth3-eth3 capble did not help (though it showed lost and re-found link messages in master's log as expected). I postponed any further tests (with a directly connceted laptop, with different cables, with trying different switch ports, etc.) for the moment because our trusted on-site "remote hands" person is currently quarantined and the replacement person that kindly helped us with all attempts so far, well, they may have done everything right according to our directions by phone and checks against photos - but maybe not; and besides that they have their normal job to do primarily. A regular visit is scheduled for next week anyway and will hopefully allow a quick run-through of all pending suggestions