Security Appliance High Availability Configuration

Security Appliance High Availability Configuration





High Availability with More Than Two Physical WAN Uplinks
Although only two active uplinks are supported at a time on an active/primary MX, additional uplinks should be utilized for tertiary failover on the secondary MX. One or two additional uplinks may be utilized on the secondary MX, and will become active when all uplinks on the primary MX fail or when a hardware failure occurs on the primary MX. These additional uplinks connected to the secondary MX can be part of a different IP subnet than the uplinks on the primary MX.

Troubleshooting Routed Warm Spare

If there is a problem with the routed HA configuration, there may be various symptoms that will affect the network, and it may not be obvious that the root cause is routed HA. This section outlines what issues with HA typically look like, as well as recommended troubleshooting steps.

Dual Active Issue

The most common sign of a problem with routed HA is a dual active scenario where both the primary and spare MX report in the dashboard as being active. This can be observed in the dashboard under Security & SD-WAN > Monitor > Appliance status and by comparing the current state of each appliance.

This will occur if the primary MX is online and sending heartbeats that aren't seen by the spare, resulting in the spare thinking that the primary is down. If both the primary and spare are in the active state, this will cause various issues with the network, affecting DHCP, routing, VPN, etc. 

Recommended Troubleshooting Steps

If network issues are occurring that appear to be related to routed HA, the following troubleshooting steps should be taken to identify the root cause:

  1. Check both appliances in the dashboard (under Security & SD-WAN > Monitor > Appliance status) to check if there is a dual active scenario as outlined above.
    1. If both appliances are consistently reporting in the "active" state, check their LAN connection and make sure they can communicate with each other. 
    2. If the spare MX is intermittently reporting as active while the primary remains online and active, check that both MXs can communicate with each other on all VLANs. Additionally, ensure there are no bad cables connecting the two devices or any other physical issue that could result in unreliable communication.
    3. In any case, it is strongly recommended to take a packet capture on the LAN side of each MX, to get a clear picture of where the VRRP heartbeats are being lost.
  2. If the HA pair is configured to use a virtual IP on the uplink, make sure that each pair of WAN connections (WAN 1 on each MX, for example) share the same broadcast domain so they can both be seen by the upstream device.

    • Related Articles

    • Appliance License Transfer

      Goal There are many scenarios that may require the transfer of a license from one Meraki dashboard organization to another. Previously, moving Co-Termination license keys between organizations could only be performed by a member of the Meraki Support ...

    • OS Client VPN Setup

      Client VPN OS Configuration This article outlines instructions to configure a client VPN connection on commonly used operating systems. For more information about client VPN, please refer to our Client VPN Overvi documentation. For troubleshooting, ...

    • SCW Viewing Software

      SCW offers multiple viewing options of the NVR including Web Browser, Windows Client, MacOS Client as well as iOS and Android apps. Admiral Line of NVR software links below: https://www.getscw.com/security-camera-software/admiral **Login requires ...

    • QoS Implementation for MS Teams Voice

      Quality of Service (QoS) in Microsoft Teams allows real-time network traffic that's sensitive to network delays (for example, voice or video streams) to "cut in line" in front of traffic that's less sensitive (like downloading a new app, where an ...

    • SCW 24 Port PoE Switch - Tech Specs

      24×10/100Mbps POE Ethernet ports 2×Gigabit combo ports (use either RJ45 or SFP, for each) PoE complies with IEEE802.3af/at, up to 30W for single port Up to 750 feet transmission distance with SCW Admiral or Imperial line cameras. Easy to use, no need ...