Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 8851 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Interface tracking / reachablity check in HA

Emre Tayfur

Hello all,

 

I have 2 Sophos UTM 9 for redundancy. I configured them in HA. Now I would like to have interface tracking or reachibility check so that if one interface down, the othe pair should be Master. How can I manage to do it in configuration?

 

Thank you



This thread was automatically locked due to age.
Parents
  • 0

    Hi Emre,

    While configuring HA, you will get two options to select, 

    1. Select a preferred Master
    2. Select a backup interface

    Preferred master: Here you can define a designated master node by selecting a node from the drop-down list. In case of a failover, the selected node will not stay in Slave mode after the link recovers but instead will switch back to Master mode.

    Backup interface: To prevent that both master and slave become master at the same time (master-master situations), for example, because of a failure of the HA synchronization interface or an unplugged network cable, a backup heartbeat interface can be selected. This additional heartbeat interface can be any of the configured and active Ethernet interfaces (not Ethernet Bridge or Ethernet VLAN). If a backup interface is selected, an additional heartbeat signal is sent via this interface in one direction from the master to the slave to make sure that the master-slave configuration stays intact. If the master-slave connection is disabled and the backup interface becomes involved, the administrator will receive a notification informing that one of the cluster nodes is dead. However, this option is of no effect on slave systems, so you can leave it unconfigured.

    Thanks

Reply
  • 0

    Hi Emre,

    While configuring HA, you will get two options to select, 

    1. Select a preferred Master
    2. Select a backup interface

    Preferred master: Here you can define a designated master node by selecting a node from the drop-down list. In case of a failover, the selected node will not stay in Slave mode after the link recovers but instead will switch back to Master mode.

    Backup interface: To prevent that both master and slave become master at the same time (master-master situations), for example, because of a failure of the HA synchronization interface or an unplugged network cable, a backup heartbeat interface can be selected. This additional heartbeat interface can be any of the configured and active Ethernet interfaces (not Ethernet Bridge or Ethernet VLAN). If a backup interface is selected, an additional heartbeat signal is sent via this interface in one direction from the master to the slave to make sure that the master-slave configuration stays intact. If the master-slave connection is disabled and the backup interface becomes involved, the administrator will receive a notification informing that one of the cluster nodes is dead. However, this option is of no effect on slave systems, so you can leave it unconfigured.

    Thanks

Children
  • 0 in reply to sachingurung

    Hi sachingurung,

     

    Thank you for your explanation. Probably I could clearly explain my problem because your explanation is not a solution for me.

     

    I have 2 Sophos and their both E0 ports are conencted to 2 swtiches (for example).

    Let's say 1st sophos is master. Meanwhile, if switch 1 is down, 1st sophos is still Master which I don't want. I want to track E0 so that when this port is down (or lost reachibility to switch 1), I want the other pair of Sophos bacame Master. 

     

    I hope it is better explanation.

     

    Thank you

  • +1 in reply to Emre Tayfur

    In that case, go to Interfaces & Routing > Interface > Hardware > Eth0; select the HA Link Monitoring on the interface.  In case of a link failure, as stated by you, a takeover will be triggered. It is not recommended because it can cause unnecessary failures at the time. Also, if a configured interface is not always connected (e.g. management interface) please disable HA link monitoring for the corresponding interface. Otherwise all HA nodes will stay in status UNLINKED.

    Thanks

  • 0 in reply to sachingurung

    Thank you for your answer again. It was already enabled on all interfaces and it was leading the problem with HA status. After I disable HA link monitoring in unused ports, it seems it is working now.