Edge deactivating after a HA failover.

Products

• VMware VeloCloud SD-WAN

Issue/Introduction

This article discusses edges that de-activate suddenly after a HA failover.

Cause

-When the edge is in HA state after activation, the VCO communicates with the Active edge and if the standby edge is also properly activated, the active edge will send a HA_STANDBY_ACTIVATED event to the VCO which ensures that both active and standby are properly activated with the correct certificate.

-If the standby edge is not properly re-activated/activated while the active edge is activated, the edge will continue to function without any issues, but if a HA failover occurs, the VCO will notice that the standby box is using incorrect certificates/information, then the VCO will de-activate the edge automatically and this will need proper factory reset/activation.

-During that time, we can identify that this is the issue by checking the below logs:

2024-03-01T00:21:19.664 DEBUG   [mgd (19814:Heartbeat:26709)] Including standBy identity certificate digest  in heartbeat
2024-03-01T00:21:49.409 DEBUG   [mgd (19814:Heartbeat:26709)] Including standBy identity certificate digest  in heartbeat
2024-03-01T00:22:19.604 DEBUG   [mgd (19814:Heartbeat:26709)] Including standBy identity certificate digest  in heartbeat
---------------
2024-03-01T00:22:44.383Z - warning: [a1216539-a331-46~956b.170924278.154756] [37077] Ignoring heartbeat from edge [NADFWVSDW000 05faf5558b05b544105c453f96f43985a52fc81e 8FR5SR3] - using revoked client certificate 
------------------
2024-03-01T00:22:44.328 DEBUG   [heartbeat (12200:Heartbeat:12708)] Heartbeat reply: Configurations={}, Actions={"action": "deactivate"}
2024-03-01T00:22:44.328 INFO    [mgd (12200:Heartbeat:12708)] VCO requested edge to deactivate itself
----------------

 

Resolution

This is an expected behavior of the edge, when the certificates do not match the VCO will trigger a de-activation request on the VCO after the failover and this is the expected behavior.