Jump to:navigation, search
Wiki

UTM Cluster Management

From Securepoint Wiki





























In dieser Seite werden die Variablen für unterschiedliche Sprachen definiert.
Diese Seite wird auf folgenden Seiten eingebunden




























































Firmware management, updates, configuration management and maintenance mode

Last adaptation to the version: 14.2.0 (07.2026)

New:
  • Beta For participants on the Beta Channel only:
notempty
This article refers to a Beta version

14.0.0 12.6 12.5 12.4 11.7

Access: UTM-IP:Port or UTM-URL:Port
Port as configured at Network / Appliance Settings / Webserver
Default-Port: 11115
i.e.: https://utm.ttt-point.de:11115
Default: https://192.168.175.1:11115 Network Cluster Configuration Area Management

Preliminary note

  • Before the update is carried out on the cluster system, the functionality (see description "Test procedure") must be tested with the current version.
    If the test is not successful, the update process may be disrupted.
  • In order to quickly distinguish between the primary UTM and the spare UTM, the header of the spare UTM is gray and the path of the device is titled (passive cluster UTM).
    Cluster configuration UTMuser@spare.name.fqdn (passive cluster UTM) Network
  • notempty
    New as of v14.0:
    If the cluster is not synchronised, there is also a message in the header, a warning in the side menu and a message dialogue when the admin web interface is called up.

Updates in the cluster regarding UTM Update 14.1.3

notempty

Due to a change in password handling for clusters, the primary and spare UTMs may switch to active mode at the same time.

This behaviour occurs only once when updating from UTM version 14.0.12 or earlier to version 14.1.3 (or later).

To avoid this situation, we recommend the following procedure:

  • Enable maintenance mode on the spare UTM
  • Update the primary UTM to version 14.1.3
  • Update the spare UTM to version 14.1.3

Please note that this will result in a brief interruption to network traffic until the primary UTM is back online


Settings in the tab Management

Settings in the tab Management

Status

Status
Caption Value Action Description Cluster configuration UTMuser@firewall.name.fqdn Network
Management tab
Cluster status: The status of the cluster, if green the current UTM is active, if yellow it is ready as a backup but not active. Clicking on the button updates the information.
Synchronization status: Shows whether the configurations of the UTMs are synchronized; if not, this can be changed using the button.

Firmware

Firmware
Installed firmware of the remote terminal: 12.6.1 Displays the used firmware version of the cluster partner.
Clicking the button updates the information.
Installed version: 12.6.1
Available version: 12.6.1.1 (Newer version)
Available version: 12.6.0 (Older version)

Hovering over the version information displays information about the versions available in each case.
Locally installed firmware: 12.6.1 Displays the locally installed version.
Clicking the button transfers this firmware version to the remote terminal.
  • Only possible if the local version is newer (highlighted in green) than the version of the remote terminal
    • Locally available firmware: -
    12.6.1    		 Displays a locally available version if it is newer than the locally installed version.
  • Button is disabled if the local version is not newer (grayed out) than the version installed on the remote terminal.

    • Configuration

    Configuration
    Synchronize configuration: Transfers the local configuration to the remote terminal
    notempty
    New as of v12.6.1:
    • Checking the interfaces through dialog (see image)
  • If the assignment is not adjusted, these interfaces are marked as Unmatched on the Spare UTM (see figure on the right)
    • Synchronization of virus patterns and mail archive hashes (spam)
    • The Bond interfaces are only configured on the primary
    • The configuration of the bond interfaces is completely transferred to the spare during synchronization
    • Exception: The host MAC address is not' synchronized
      • During initial synchronization, an address of the interfaces involved is automatically selected as the host MAC address on the spare
      • A subsequently selected MAC address on the spare is not changed by subsequent synchronization
    Synchronize configuration: Check interfaces
    Unmatched interfaces on the remote station
    Reset configuration: Resets the cluster configuration of the local UTM to factory defaults
    (Requires additional confirmation).

    Maintenance Mode

    Maintenance Mode
    Maintenance Mode: Off On Activates the maintenance mode
    • The maintenance mode is used to switch to the spare in a controlled manner and prevents multiple switching in the case of several individual steps (i.e. change IP of addresses)
    • The services available in maintenance mode are configured in the wizard in step 4 or under Network Cluster configuration Area Applications.
    • The UTM is not accessible via the virtual IP in maintenance mode, but only via a fixed IP address.
  • If the cluster maintenance mode is activated in an active web session, the web session closes. The UTM can then no longer be administrated via the portal.
  • If the spare is in maintenance mode, it will not become the active cluster member in the event of a failure of the primary.
  • Maintenance mode is not persistent. After a restart (e.g. during an update) maintenance mode is not active

    • CLI commands for maintenance mode can be found in a separate Wiki article.


    Firmware updates in the cluster

    notempty

    Due to a change in password handling for clusters, the primary and spare UTMs may switch to active mode at the same time.

    This behaviour occurs only once when updating from UTM version 14.0.12 or earlier to version 14.1.3 (or later).

    To avoid this situation, we recommend the following procedure:

    • Enable maintenance mode on the spare UTM
    • Update the primary UTM to version 14.1.3
    • Update the spare UTM to version 14.1.3

    Please note that this will result in a brief interruption to network traffic until the primary UTM is back online

    Update Spare
    Step 1 Update Spare
    • An update version of the firmware must be available. If necessary download the latest firmware under Extras Firmware Updates with the button Download latest firmware.
    • The update should first be installed on the spare.
      The installation first on the spare allows e.g. a review of the settings and hardware compatibility

      If the Spare does not have Internet access, the update version can be transferred from the Primary to the Spare under Network Cluster Configuration Area Management (see section Firmware).
    • Installation in menu Extras Firmware Updates button Start trial run
    Testing Spare
    Step 2 Testing Spare
    • After the update has been installed on the spare, the web interface of the spare UTM is opened. Here select the option Ask again later.
    • Check if the update has been installed properly.
    • If problems occur, the Cancel trial run button can be used to roll back.
  • If the test run is not completed, the UTM automatically performs a rollback at the next startup.
    • Update Primary
    Step 3 Update Primary
    • Before the update is installed on the Primary, the maintenance mode should be activated here under Network Cluster Configuration Area Management (see above) should be activated
    • Now the update can be installed on the primary UTM. During the installation of the update, the primary UTM is restarted in the meantime. Maintenance mode is not persistent. The primary becomes the active device again after the reboot.
    Testing Primary
    Step 4 Testing Primary
    • Once the UTM has been restarted, maintenance mode will also be exited if it was active. The spare will switch to backup mode and the primary to active mode.
  • The firmware should not be finalized during the first login.
    • If problems occur, the Cancel trial run button can be used to roll back.
  • If a rollback is performed on the primary, this must then also be performed on the spare so that both cluster partners have the same firmware version. Extras Firmware Updates Older version Start trial run
  • If the test run is not completed, the UTM automatically performs a rollback at the next startup.
    • Finally, maintenance mode is disabled
    Testing Spare Primary
    Step 5 Finalisieren Spare Primary
    • Wenn alles tadellos funktioniert, dann finalisiert man auf beiden UTMs das Update im Menü Extras Firmware Updates button Probelauf abschließen

    Test of the cluster functionality

    After the update has been installed on the UTMs, the cluster functionality should still be tested in the event of a failure of the HA interfaces to ensure that the cluster behaves properly in the event of a failure.

    notempty
    If problems occur after the update, a rollback to the previous version can be performed.


    Simulation: Failure of the primary UTM

    Test: The primary UTM must be shut down properly via the interface.
    Expected behavior: The spare UTM takes over the function.


    Simulation: Failure of an HA interface on the primary UTM
    Test:The network cable must be removed from an HA marked interface.
  • This test should be carried out with each HA interface.
    • Expected behavior: The spare UTM takes over the function.


    Synchronisation of the configuration

    Test: After the successful test, the synchronisation of the configuration between the primary and spare UTM must be tested.
    Expected behavior: The synchronisation of the configuration takes place without errors.

    Retrieved from "https://wiki.securepoint.de/index.php?title=UTM/NET/Cluster-Management&oldid=109507"