Working with VSX Cluster Members

This section presents procedures for adding and deleting VSX Cluster Members.

Adding a New Member

Important - Make sure that no other administrators are connected to the Management Server before you perform this procedure. The vsx_util command cannot modify the management database, if the database is locked because other administrators are connected.

To add a new VSX Cluster Member to an existing VSX Cluster:

1. Close all SmartConsole windows.
2. Create a full backup of the environment (see sk100395).
3. Connect to the command line on the Management Server.
4. Log in the Expert mode.
5. Run the vsx_util add_member command and follow the on-screen instructions:
   1. Enter the IP address of the Security Management Server or Main Domain Management Server.
   2. Enter the Management Server administrator user name and password.
   3. Follow the on-screen instructions.
6. Wait until the add member operation finished successfully message appears, indicating that the database has been successfully updated and saved.

   Note - In a Multi-Domain Server environment, this operation skips all Domain Management Servers locked by an administrator. If this should occur, run the command again for the affected Domain Management Servers once they become available.

7. Connect with SmartConsole to the Security Management Server or Main Domain Management Server used to manage the VSX Cluster.
8. From the Gateways & Servers view or Object Explorer, double-click the VSX Cluster object.
9. From the left tree, click Cluster Members.
10. Make sure you see an object representing the new VSX Cluster Member.
11. If necessary, modify the VSX Cluster object configuration and click OK.
12. Close all SmartConsole windows.
13. Connect to the command line on the Management Server.
14. Log in the Expert mode.
15. Run the vsx_util add_member_reconf command and follow the on-screen instructions.
16. Wait until the Reconfigure module operation completed successfully summary notice appears.

    Note - In a Multi-Domain Server environment, the operation skips all Domain Management Servers locked by an administrator. If this should occur, run the command again for the affected Domain Management Servers when they become available.

17. Reboot the new VSX Cluster Member.
18. Connect to the command line on each VSX Cluster Member.
19. Examine the VSX Cluster configuration:

    cphaprob state

20. If the VSX Cluster runs in the VSLS mode:
    1. Connect to the command line on the Management Server.
    2. Log in the Expert mode.
    3. Redistribute Virtual Systems to the newly added VSX Cluster Member:

       vsx_util vsls

    4. Connect to the command line on each VSX Cluster Member.
    5. Examine the VSX Cluster configuration:

       cphaprob state

Deleting a Member

Important - Make sure that no other administrators are connected to the Management Server before you perform this procedure. The vsx_util command cannot modify the management database if the database is locked.

To remove a VSX Cluster Member from a VSX Cluster:

1. Close all SmartConsole windows.
2. Create a full backup of the environment (see sk100395).
3. Detach the license from the VSX Cluster Member to be removed. Otherwise, you cannot remove a VSX Cluster Member.
4. Close all SmartConsole windows.
5. Connect to the command line on the Management Server.
6. Log in the Expert mode.
7. Run the vsx_util remove_member command and follow the on-screen instructions:
   1. Enter the IP address of the Security Management Server or Main Domain Management Server.
   2. Enter the Management Server administrator user name and password.
   3. Type 'y' to confirm that you have detached the license from the VSX Cluster Member.
   4. Select the VSX Cluster.
   5. Select the VSX Cluster Member.
   6. Type 'y' to confirm that the VSX Cluster Member to be removed is disconnected.
8. Wait until the remove member operation finished successfully message appears.

   Note - In a Multi-Domain Server environment, this operation skips all Domain Management Servers locked by an administrator. If this should occur, run the command again for the affected Domain Management Servers once they become available.

   The management database is now updated and saved.

   In SmartConsole, the object for the deleted VSX Cluster Member no longer appears in the specified VSX Cluster object.

9. Connect with SmartConsole to the Security Management Server or Main Domain Management Server used to manage the VSX Cluster.
10. From the Gateways & Servers view or Object Explorer, double-click the VSX Cluster object.
11. From the left tree, click Cluster Members.
12. Make sure you do not see an object representing the removed VSX Cluster Member.

Upgrading Cluster Members

This section describes the procedures for upgrading cluster members that were initially installed using an earlier version of VSX. You perform the upgrade process using the vsx_util upgrade command. Afterwards, you use the vsx_util reconfigure command to apply settings stored in the management database to the newly upgraded member.

Upgrading a Member to the Current Version

Important - Verify that no other administrators are connected to the management server before proceeding. The vsx_util command cannot modify the management database if the database is locked.

To upgrade the cluster and its members:

1. Close SmartConsole.
2. From the management server command line, enter Expert mode.
3. Run: vsx_util upgrade

   Enter when prompted:

   • Security Gateway or main Domain Management Server IP address
   • Administrator name and password
   • Cluster name
   • Select the version to upgrade to
4. Wait until the Finished upgrading/database saved successfully message appears, indicating that the database has been updated and saved.
5. Open SmartConsole and verify that an object representing the new member now appears in the specified cluster.

   Note - In a Multi-Domain Security Management environment, the operation will skip any Domain Management Servers locked by an administrator. If this should occur, run the operation again for the relevant Domain Management Servers when they become available.

6. Install VSX on each upgraded member.
7. Run the initial configuration steps on each member:
   1. Define the IP address, net mask, and default gateway.
   2. Install a valid license.
   3. Set the SIC activation key.
   4. Configure the cluster properties as required. These property settings must be the same as defined for the other cluster members.

   If you upgrade with CPUSE, you can skip the next step and reboot when the gateway is ready.

8. Run: vsx_util reconfigure

   Enter when prompted:

   1. Management server or main Domain Management Server IP address
   2. Administrator name and password
   3. SIC activation key for the upgraded member

   This action installs the existing security policy and configuration on the newly upgraded members.

9. Wait until the Finished upgrading/database saved successfully message appears.
10. Reboot each member.

Notes to the Upgrade Process

• You only need to run the vsx_util upgrade command once for each VSX cluster. You must, however, run the vsx_util reconfigure command for each cluster member.

  For example, for a deployment with two clusters, each cluster having three members, run vsx_util upgrade twice, once for each cluster object, and the vsx_util reconfigure six times, once for each cluster member.

• To ensure stability of the VSX deployment, run the vsx_util upgrade and vsx_util reconfigure consecutively. For example, run the vsx_util upgrade command for the cluster object first and then run the vsx_util reconfigure for the first member. Run vsx_util reconfigure for the second and subsequent members immediately thereafter·
• Verify that each upgraded member is fully operational before upgrading the remaining members.
• You cannot install policies until the upgrade process has completed successfully for all members.