High Availability on vmIAG 17.0.73

hriandy Lv1Posted 2024-Jun-29 02:00

Hello, I'm currently in the middle of LAB for my next POC

I'm using 2 vm IAG 17.0.73 and want to do HA active-standby mode, here's what i configure before activating HA :

IAG MAIN :
deployment : Single-arm
network int (eth0) : 172.21.101.36/255.255.255.0
mgmt int (eth1) : 172.21.102.36/255.255.255.0
HA config :


IAG SEC :
deployment : Single-arm
network int (eth0) : 172.21.101.37/255.255.255.0
mgmt int (eth1) : 172.21.102.37/255.255.255.0
HA config :

Both main and secondary device have an active license, internet access, and identical fresh configuration.

After I activate HA in both IAG, what happened is :
1. MAIN device is fine, first 5 minutes HA status is in OK, but change to the state below :

2. Secondary device lost its license, GUI sometimes cannot be accesssed, can't ping anywhere via web console and eth0 IP address is changed to the MAIN device eth0 IP address (is this normal?)

is there something i miss at configuration?

any help is appreciated. Thanks.

49432667ef7a3a053d.png (34.31 KB, Downloads: 178)

49432667ef7a3a053d.png

jerome_itable has solved this question and earned 20 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

The behavior you're encountering with your Sangfor IAG HA setup in active-standby mode suggests some configuration issues.

Here's a breakdown of the problems and potential solutions:

Secondary Device Issues:

    License Loss:  The secondary device losing its license after HA activation is a major issue. Licenses are typically tied to the device's hardware identifier (MAC address, serial number), and in HA, only the active device should actively utilize the license.

    GUI Inaccessibility & Ping Failure: This indicates potential communication problems between the secondary device and the network. The secondary shouldn't lose internet access completely, but its role might change during failover.

    IP Address Change:  The secondary device's eth0 IP address changing to the main device's eth0 IP address is not normal behavior.  Both devices in HA should have unique IP addresses.

Potential Solutions:

    License Activation: Double-check the license activation process for the secondary device. Ensure it's activated with its own unique license key. Consult Sangfor documentation or support for specific instructions on activating licenses in an HA environment.

    Network Connectivity: Verify network connectivity for the secondary device. Check firewall rules, routing configurations, and ensure proper communication exists between the secondary device and the network.

    HA Interface Configuration:  Review your HA interface configuration. The secondary device's network interface used for HA communication (typically separate from management and data interfaces) might be misconfigured.
Is this answer helpful?
Newbie290036 Posted 2024-Jul-02 19:35
  
I think there is a misconfiguration or an issue with the HA setup process for your IAG (Intelligent Access Gateway) devices. Please check this.
Zonger Lv5Posted 2024-Jul-02 18:02
  
It is misconfiguration in the HA setup of your IAG VMs. In an HA active-standby configuration, the secondary device should not lose its license or experience network interface IP conflicts.
pmateus Lv2Posted 2024-Jul-02 16:50
  
Hi,

I think  on active-standby mode the standby device will be on failed state with the configurations of the active device. So if the active device fail, the standby will assume the the active role with the same ips.

Thanks
pmateus Lv2Posted 2024-Jul-02 16:48
  
Hi,

Check the following post "#Configuration Guide# Sangfor IAM Active-Standby High Availability Configuration Guide"

https://community.sangfor.com/fo ... thread&tid=6323
Enrico Vanzetto Lv4Posted 2024-Jul-02 16:15
  
Hi, It seems like there could be an issue with the High Availability (HA) setup of your IAG Virtual Machines (VMs). In an active-standby HA configuration, the secondary device shouldn’t lose its license or encounter IP conflicts on the network interface.

Make sure that the HA configuration designates unique virtual IP addresses for failover and that both VMs are accurately configured with distinct management and network interfaces.

Double-check the HA settings on both devices, ensuring that the secondary device is correctly set as the standby and isn’t prematurely trying to take over the primary’s IP address.

Inspect for any inconsistencies in the network settings or potential IP conflicts that might lead to the secondary device losing connectivity and its license status.
mdamores Posted 2024-Jul-02 14:45
  
Hi,

Please check if the secondary device is configured as standby and both devices have unique network interface and management IP address to avoid conflict. Also, make sure that HA setup of your IAG is in HA active-standby mode.

Farina Ahmed Lv5Posted 2024-Jul-02 13:52
  
It appears there might be a misconfiguration in the HA setup of your IAG VMs. In an HA active-standby configuration, the secondary device should not lose its license or experience network interface IP conflicts. Ensure that the HA configuration specifies unique virtual IP addresses for failover and that both VMs are correctly configured with separate management and network interfaces. Verify the HA settings on both devices, making sure that the secondary device is properly set as the standby and not trying to assume the primary's IP address prematurely. Check for any discrepancies in the network settings or potential IP conflicts that might cause the secondary device to lose connectivity and license status.
Prosi Lv3Posted 2024-Jul-02 12:15
  
Thank you for sharing
vesogi7900 Lv2Posted 2024-Jul-01 12:58
  
It sounds like you’re encountering some issues with your HA setup. Here are a few things to check and try:

1. HA Configuration: Ensure that both devices have the correct HA configuration. This includes setting the correct HA roles (active and standby) and ensuring that the HA settings are identical on both devices.
2. Network Interfaces: Verify that the network interfaces are correctly configured and that there are no IP address conflicts. The issue with the secondary device taking the MAIN device’s IP address on eth0 suggests a possible misconfiguration.
3. License Synchronization: Make sure that the licenses are properly synchronized between the two devices. Sometimes, the secondary device might lose its license if there is a communication issue or if the licenses are not correctly applied.
4. HA Heartbeat: Check the HA heartbeat configuration. Ensure that the heartbeat interfaces are correctly connected and that there is no network issue causing the heartbeat to fail.
5. Logs and Diagnostics: Review the logs on both devices to see if there are any error messages or warnings that could provide more insight into the issue. This can help identify if there are any specific problems with the HA setup.
6. Documentation and Support: Refer to the official documentation for IAG 17.0.73 to ensure that all steps are correctly followed. If the issue persists, consider reaching out to Sangfor support for more detailed assistance.

Here are some general steps for configuring HA in active-standby mode12:

* Connect HA Ports: Ensure that the HA ports on both devices are connected.
* Configure HA Settings: Set the HA mode to active-standby and configure the HA group ID.
* Synchronize Configuration: Ensure that the configuration is synchronized between the primary and secondary devices.
* Monitor HA Status: After activating HA, monitor the status to ensure that both devices are correctly recognizing each other and that the failover mechanism is working as expected.

I Can Help:

Change

Moderator on This Board

1
3
5

Started Topics

Followers

Follow

Board Leaders