高可用性

高可用性

次の手順を使用し、高可用性（HA）の詳細を確認し、それに応じてこれらのシナリオの問題をトラブルシュート。

  • 接続の問題

  • 両方のピアが 非サービス モードである

  • 一方のピアがインサービスモードで、もう一方のピアがインサービスモードではない

  • 両方のピアがインサービス モードである

  • メンバーシップの失敗

高可用性接続の問題

Hypershield Agent 間の高可用性（HA）接続は、次の場合にのみ実現されます：

  • HA 設定が完全かつ正しく対称である

  • HA が有効になっていて、および

  • ファイアウォール サービスが構成されていることを確認します。

接続の問題をトラブルシューティングするには、次の手順を実行します：

  • HA 設定を確認するには、次の手順を実行します。

  • ピアとコンテナ間のネットワーク接続を確認します。

  • 高可用性の Hypershield Agent の状態を確認します。

手順

ステップ 1

高可用性ステータスとロールを確認します。

例:

show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.1)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: not-ready
    Agent HA Status: not-ready
    Peers:
      PeerIP              Peer Service State  HA State with Peer  Reason
      ------------------- ------------------  ------------------  --------------
      192.1.1.2           unknown             no-ha               no peer connectivity

ステップ 2

各ピアでのサービス アクセラレーション構成とネットワーク構成とルートを確認します。

  • HA 設定が完全かつ正しく対称であること

  • HA が有効になっています

  • ファイアウォール サービスが構成されていることを確認します。

例:

switch# show run service-acceleration
<<snip>>
version 10.6(3q) Bios:version 01.17
feature service-acceleration
service system hypershield
  source-interface loopback2
  high-availability
    source-interface loopback1
    peer 192.1.1.2
    no shutdown
  service firewall
    vrf tenant1 module-affinity dynamic
    vrf tenant2 module-affinity dynamic
    vlan id 2003,2005 bridged-traffic module-affinity dynamic

ステップ 3

ローカル HA IP から設定されたピアへの HA 接続用にネットワーク設定が設定されていることを確認します。この例では、ループバック インターフェイスは正しい IP アドレスおよび OSPF 設定で構成されています。ルーティング テーブルには、イーサネット インターフェイスを介して OSPF を使用して到達可能な接続先へのルートが表示されています。

例:

switch# show run interface loopback 1
<<snip>>
version 10.6(3q) Bios:version 01.17
interface loopback1
  ip address 192.1.1.1/32
  ip ospf cost 1
  ip router ospf 10 area 0.0.0.0
  ipv6 router ospfv3 10 area 0.0.0.0
switch# show ip route 192.1.1.2
IP Route Table for VRF "default"
<<snip>>
192.1.1.2/32, ubest/mbest: 1/0
    *via 192.1.1.2, Eth1/16/3, [110/2], 00:22:46, ospf-10, intra
     via 192.1.1.2, Eth1/16/3, [250/0], 00:20:51, am

ステップ 4

各ピアで HA 整合性チェッカーを実行し、Hypershield Agent の駆動状態で NX-OS構成を検証し、不一致を検出します。

例:

switch# show consistency-checker service-acceleration high-availability
======================================================
PROCESSING HIGH-AVAILABILITY CONSISTENCY CHECK REQUEST
======================================================
****************************************
HA FIREWALL STATE CONSISTENCY
****************************************
  [PASS] Firewall configured and internal states match: out-of-service --> Firewall is created
  [PASS] Agent's firewall readiness state matches internal readiness state: not-ready
  [PASS] Agent's firewall readiness state matches published readiness state: not-ready
****************************************
FW VLAN OPERATIONAL STATE CONSISTENCY
****************************************
FW L2, L3 VLAN Set Consistency Checks
======================================
  Expected L3 FW VLANs (from VRFs): 656-657,659,755,859
  Expected L2 FW VLANs : 2003,2005
  Expected Combined L2+L3 VLANs: 656-657,659,755,859,2003,2005
  L3 VLAN Comparison:
    [PASS] L3 VLANs match published FW L3 VLANs
  L2 VLAN Comparison:
    [PASS] L2 VLANs match published FW L2 VLANs
  Combined L2+L3 VLAN Comparison:
    [PASS] Combined L2+L3 FW VLANs identified as expected
****************************************
HA PEER CONSISTENCY
****************************************
HA Configuration and Peer State Checks
=======================================
  HA Admin State Comparison:
    [PASS] HA admin state matches with internal state: no-shutdown  --> HA is enabled
  HA Source interface Comparison:
    [PASS] HA Source interface matches: loopback1
  HA Source IP Address Comparison:
    [PASS] HA source IP address matches: 192.1.1.2
  HA Peer Configuration Validation:
    [PASS] Peer 192.1.1.1 found internally.
    HA Peer State Validation:
    [PASS] Internal Peer service state for peer 192.1.1.1 matches service state published by agent: unknown 
            --> Peer is configured
    [PASS] Peer 192.1.1.1 derived firewall state matches: 'unknown'
  [NOTE] HA Troubleshooting Suggestion:
    Detected 1 peer(s) with service state unknown:
      - Peer 192.1.1.1: unknown
    To identify HA peer connectivity issues, run:
      service system hypershield test high-availability
HA VPC Peer Consistency Checks
===============================
  Validating HA Peer Info:
  Internal Peer state validation:
    VPC peer is alive
    [PASS] Peer 192.1.1.1 is being detected as an alive VPC peer
  VPC Peer Firewall State Validation:
    [PASS] Internally known HA VPC peer firewall state is 'unknown' (VPC peer exists)
    [PASS] Published HA VPC peer firewall state is 'unknown' (VPC peer exists)
VPC State Consistency Checks
=============================
  Validating 4 VPC(s)
  VPC 60 (Po60):
    [Pass] Internal details for VPC 60 matches configuration
    [PASS] VPC 60 is of interest and allows 3 FW l2/l3 VLAN(s): 657,659,2005
  VPC 61 (Po61):
    [Pass] Internal details for VPC 61 matches configuration
    [PASS] VPC 61 is of interest and allows 2 FW l2/l3 VLAN(s): 656,2005
  VPC 62 (Po62):
    [Pass] Internal details for VPC 62 matches configuration
    [PASS] VPC 62 is of interest and allows 2 FW l2/l3 VLAN(s): 755,2003
  VPC 63 (Po63):
    [Pass] Internal details for VPC 63 matches configuration
    [PASS] VPC 63 is of interest and allows 1 FW l2/l3 VLAN(s): 2003
****************************************
HA VRF/VLAN OPERATIONAL STATE CONSISTENCY
    [PASS] 2 VRF(s) were validated and are in 'isolated' state
    [PASS] VLANs 2003,2005 were validated and are in 'VLAN set to drop' state
    [SKIP] VRF/VLAN vpc peer consistency checks skipped - one or both firewalls not ready
    [SKIP] VLAN peer consistency checks skipped - one or both firewalls not ready
=========================================================================================
HIGH-AVAILABILITY CONSISTENCY CHECK COMPLETED - ALL CHECKS PASSED
=========================================================================================

ステップ 5

ネットワーク接続のトラブルシューティング ツールを実行して、ピアの Hypershield Agent へのネットワーク接続の問題を検出します。

例:

switch# service system hypershield test high-availability
==============================
Running HA config checks
==============================
Using loopback 1 as the HA source-interface.
1 HA peers configured.
HA admin state is enabled.
=================================================
Running HA operational checks
=================================================
local svc is not fully functional : criteria not met: in_service
Hypershield peer 192.1.1.1 not functional: print peer HA svc state reason.
=================================================
Starting network connectivity checks for the peers
=================================================
Using curl to check connection to 192.1.1.1 port 28416
curl: (1) Received HTTP/0.9 when not allowed
Curl successfully connected to 192.1.1.1:28416. Collect 'show tech service-acceleration' to debug any agent connectivity failure
HA network connectivity check completed for peer with IP 192.1.1.1

両方のピアが非サービス モードです

両方のピアが vPC の インサービス トラフィックなし であり、ブリッジド トラフィックが両方の vPC ピアでオフになっている場合、レイヤ 3 またはレイヤ 2ファイアウォールVLAN である VLAN を伝送する vPC は一時停止されません。

VRF は両方のピアで分離された状態のままになります。詳細については、「ファイアウォールの立ち上げ前のネットワーク構成」を参照してください。

VRF または VLAN 宛のトラフィックはすべてドロップされます。詳細については、「ファイアウォールの立ち上げ前のネットワーク構成」を参照してください。


（注）  

ファイアウォールが稼働していない場合、DPU のキープアライブと同期は無効になります。現時点では、Hypershield Agent のみが HA 接続を確立します。

手順

ステップ 1

両方のピアは、ローカルの状態を not-ready と報告し、ピアサービスの状態を not-ready として報告する必要があります。ピアの HA 状態が両側で使用できない。

例:

switch(config)# show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.1)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: not-ready   --> local service is not ready
    Agent HA Status: unavailable
    Peers:
      PeerIP              Peer Service State  HA State with Peer  Reason
      ------------------- ------------------  ------------------  --------------
      192.1.1.2           not-ready           ha-unavailable      local and peer service failure

ステップ 2

Hypershield エージェント HA 情報/構成を確認します。

例:

switch # service system hypershield connect session /usr/src/app/agwctl ha info
Client got: ok
Data:
=== HA Info ===
Admin State:        enabled
Oper State:         ha-ready
Leader:             false  --> After HA connectivity is established peer with lower IP/ready is leader
HA IP:              192.1.1.2
HA Port:            28416
Policy Check:
Policy Rev:
Configured Peers:   192.1.1.1
<<snip>>

例:

HA ピアでの出力

switch(config)# service system hypershield connect session /usr/src/app/agwctl ha info
Client got: ok
Data:
=== HA Info ===
Admin State:        enabled
Oper State:         ha-ready
Leader:             true    --> After HA connectivity is established peer with lower IP/ready is leader
HA IP:              192.1.1.1
HA Port:            28416
Policy Check:
Policy Rev:
Configured Peers:   192.1.1.2
<<snip>>

一方のピアがインサービス モードであり、もう一方のピアは、インサービス モードでは、ありません

一方のピアが [非インサービス（no in-service）] で、もう一方のピアが [インサービス（in-service）]である場合、トラフィックはインサービスのピアの方向に変更する必要があります。

  • Hypershield Agent と NXOS の FW サービスが、 で [インサービス（in-service）] いるピアで準備ができていることを確認します。

  • ピア間の状態の可視性を確認します。

  • FW 準備ができているピアで VPC およびブリッジドトラフィックの変更がオフになっていることを確認します。

  • VRF が分離されなくなり、トラフィックが FW 対応のピアの DPU にリダイレクトできることを確認します。詳細については、「パケット転送」を参照してください。

  • FW の準備ができていないピアで、vPC およびブリッジド トラフィックの変更が有効になっていることを確認します。

  • DPU キープアライブと同期は、インサービスではないピアでは引き続き無効です。

手順

ステップ 1

HA 状態を検証します。

例:

準備ができていないピアでの出力
switch# show service-acceleration high-availability status 
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.1)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: not-ready
    Agent HA Status: unavailable
    Peers:
      PeerIP         Peer Service State  HA State with Peer  Reason
      -------------- ------------------  ------------------  --------------
      192.1.1.2      ready               ha-unavailable      local service failure

例:

準備ができているピアでの出力
switch# show service-acceleration high-availability status 
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.2)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: ready
    Agent HA Status: not-ready
    Peers:
      PeerIP         Peer Service State  HA State with Peer  Reason
      -------------- ------------------  ------------------  --------------
      192.1.1.1      not-ready           ha-unavailable      peer service failure

サービス中のピアは、ローカル状態を Ready と報告し、リモート状態を not-ready と報告します。同様に、インサービスではないピアは、ローカル状態を not-ready 、リモート状態を Ready と報告します。

オンボーディングされたピアで HA 状態が準備されておらず、他のピアで使用できません。

ステップ 2

各ピアで HA 整合性チェッカーを実行し、NX 構成およびエージェント駆動状態で状態を検証し、トラフィックの偏差の予想値を検証します。

例:

準備ができていないピアでの出力
switch# show consistency-checker service-acceleration high-availability 
======================================================
PROCESSING HIGH-AVAILABILITY CONSISTENCY CHECK REQUEST
======================================================
****************************************
HA FIREWALL STATE CONSISTENCY
****************************************
  [PASS] Firewall configured and internal states match: out-of-service
                  --> HA Peer that is not in-service
  [PASS] Agent's firewall readiness state matches internal readiness state: not-ready
  [PASS] Agent's firewall readiness state matches published readiness state: not-ready
****************************************
FW VLAN OPERATIONAL STATE CONSISTENCY
****************************************
FW L2, L3 VLAN Set Consistency Checks
======================================
  Expected L3 FW VLANs (from VRFs): 656-657,659,755,859
  Expected L2 FW VLANs : 2003,2005
  Expected Combined L2+L3 VLANs: 656-657,659,755,859,2003,2005
  L3 VLAN Comparison:
    [PASS] L3 VLANs match published FW L3 VLANs
  L2 VLAN Comparison:
    [PASS] L2 VLANs match published FW L2 VLANs
  Combined L2+L3 VLAN Comparison:
    [PASS] Combined L2+L3 FW VLANs identified as expected
****************************************
HA PEER CONSISTENCY
****************************************
HA Configuration and Peer State Checks
=======================================
  HA Admin State Comparison:
    [PASS] HA admin state matches with internal state: no-shutdown
  HA Source interface Comparison:
    [PASS] HA Source interface matches: loopback1
  HA Source IP Address Comparison:
    [PASS] HA source IP address matches: 192.1.1.1
  HA Peer Configuration Validation:
    [PASS] Peer 192.1.1.2 found internally.
  HA Peer State Validation:
    [PASS] Internal Peer service state for peer 192.1.1.2 matches service state published by agent: ready
    [PASS] Peer 192.1.1.2 derived firewall state matches: 'ready'
HA VPC Peer Consistency Checks
===============================
  Validating HA Peer Info:
  Internal Peer state validation:
    VPC peer is alive
    [PASS] Peer 192.1.1.2 is being detected as an alive VPC peer --> vPC peer is being detected
  VPC Peer Firewall State Validation:
    [PASS] Internally known HA VPC peer firewall state is 'ready' (VPC peer exists)
    [PASS] Published HA VPC peer firewall state is 'ready' (VPC peer exists)
VPC State Consistency Checks
=============================
  Validating 4 VPC(s)
  VPC 60 (Po60):
    [Pass] Internal details for VPC 60 matches configuration
    [PASS] VPC 60 is of interest and allows 3 FW l2/l3 VLAN(s): 657,659,2005
    [PASS] VPC 60 state is 'down' (local FW not-ready, peer FW ready)
      State reason: suspended by service-acceleration
  VPC 61 (Po61):
    [Pass] Internal details for VPC 61 matches configuration
    [PASS] VPC 61 is of interest and allows 2 FW l2/l3 VLAN(s): 656,2005
    [PASS] VPC 61 state is 'down' (local FW not-ready, peer FW ready)
      State reason: suspended by service-acceleration
  VPC 62 (Po62):
    [Pass] Internal details for VPC 62 matches configuration
    [PASS] VPC 62 is of interest and allows 2 FW l2/l3 VLAN(s): 755,2003
    [PASS] VPC 62 state is 'down' (local FW not-ready, peer FW ready)
      State reason: suspended by service-acceleration
  VPC 63 (Po63):
    [Pass] Internal details for VPC 63 matches configuration
    [PASS] VPC 63 is of interest and allows 1 FW l2/l3 VLAN(s): 2003
    [PASS] VPC 63 state is 'down' (local FW not-ready, peer FW ready)
      State reason: suspended by service-acceleration
****************************************
HA VRF/VLAN OPERATIONAL STATE CONSISTENCY
****************************************
    [PASS] 2 VRF(s) were validated and are in 'isolated' state
    [PASS] VLANs 2003,2005 were validated and are in 'VLAN set to drop' state
    [SKIP] VRF/VLAN vpc peer consistency checks skipped - one or both firewalls not ready
    [SKIP] VLAN peer consistency checks skipped - one or both firewalls not ready
=========================================================================================
HIGH-AVAILABILITY CONSISTENCY CHECK COMPLETED - ALL CHECKS PASSED
=========================================================================================

ステップ 3

vPC が、非サービス モードのピアで一時停止されず、インサービス モードのピアで一時停止されないことを確認します。

例:

準備ができていないピアでの出力
switch# show vpc brief 
<<snip>>
vPC domain id      : 1   
Peer status        : peer adjacency formed ok      
vPC keep-alive status    : peer is alive                 
vPC role                          : primary                       
<<snip>>
vPC Peer-link status
------------------------------------------------
id    Port   Status Active vlans    
--    ----   ------ ----------------------------
1	Po900  up        656-657,659,755,757-
                    759,859,2003,2005,2007,2009
vPC status
------------------------------------------------
Id    Port          Status Consistency Reason                Active vlans
--    ------------  ------ ----------- ------                ---------------
60    Po60          down*  success     success               -                                                                                                                
61	Po61             down*  success     success             -                           
<<snip>>
switch# show interface port-channel 60-61 br
------------------------------------------------------------------------------------------
Port-channel VLAN    Type Mode   Status  Reason                              Speed   Protocol
Interface                                                                            
------------------------------------------------------------------------------------------
Po60         1       eth  trunk  down    suspended by service-acceleration     auto(D)  none
Po61         1       eth  trunk  down    suspended by service-acceleration     auto(D)  none

ステップ 4

準備ができていないピアで HSRP グループが INIT 状態のままになっている間、VRF は分離されなくなるため、 HSRP グループが準備ができているピアでアクティブに移行することを確認します。vPC は HSRP active-active を使用するため、準備ができていない HA vPC ピアで vPC が一時停止された結果、 VIP へのトラフィック偏差が発生します。

例:

準備ができていないピアでの出力
switch# show hsrp group 656
Vlan656 - Group 656 (HSRP-V2) (IPv4)
  Local state is Initial(VRF Isolation Enabled), priority 110 (Cfged 110), may preempt
    Forwarding threshold(for vPC), lower: 0 upper: 110 
  Hellotime 3 sec, holdtime 10 sec
  Virtual IP address is 166.1.1.6 (Cfged)
  Active router is unknown
  Standby router is unknown 
  Authentication text "cisco"
  Virtual mac address is 0000.abcd.0656 (Cfged MAC)
  3 state changes, last state change 1d14h
  IP redundancy name is hsrp-Vlan656-656 (default)

例:

準備ができているピアでの出力
switch# show hsrp group 656
Vlan656 - Group 656 (HSRP-V2) (IPv4)
  Local state is Active, priority 100 (Cfged 100), may preempt
    Forwarding threshold(for vPC), lower: 0 upper: 100 
  Hellotime 3 sec, holdtime 10 sec
  Next hello sent in 1.394000 sec(s)
  Virtual IP address is 166.1.1.6 (Cfged)
  Active router is local
  Standby router is unknown 
  Authentication text "cisco"
  Virtual mac address is 0000.abcd.0656 (Cfged MAC)
  7 state changes, last state change 01:33:43
  IP redundancy name is hsrp-Vlan656-656 (default)

ステップ 5

Hypershield エージェント HA 情報/構成を確認します。準備ができているピアが、リーダーの役割を担います。

例:

switch# service system hypershield connect session /usr/src/app/agwctl ha info
Client got: ok
Data:
=== HA Info ===
Admin State:        enabled
Oper State:         ha-ready
Leader:             true            --> Role switches to leader since it is “ready”
HA IP:              192.1.1.2
HA Port:            28416
Policy Check:       false
Policy Rev:
Configured Peers:   192.1.1.1

switch# service system hypershield connect session /usr/src/app/agwctl ha info
Client got: ok
Data:
=== HA Info ===
Admin State:        enabled
Oper State:         ha-ready
Leader:             false        --> Role is follower since it is “not-ready” 
HA IP:              192.1.1.1
HA Port:            28416
Policy Check:       false
Policy Rev:
Configured Peers:   192.1.1.2

両方のピアがインサービス モードです

両方のピアがインサービス モードの場合、両方のピアが FW の準備ができているときに、トラフィックの偏差をオフにする必要があります。

  • 各ピアで FW の準備状況を確認します。

  • ピア間の状態の可視性を確認します。

  • vPC およびブリッジド トラフィック ディフレクションが両方のピアでオフになっていることを確認します(前のセクションを参照)。

  • VRF の分離がなくなり、トラフィックが FW 対応のピアの DPU にリダイレクトできることを確認します（「パケット転送 」を参照）。

  • ピア間のフロー同期を確認します。

手順

ステップ 1

両方のピアがローカルおよびピアの状態を Ready と報告することを確認します。HA 状態は両方のピアで準備完了です。

例:

1 つのピアでの出力
switch# show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.1)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: ready
    Agent HA Status: ready
    Peers:
      PeerIP         Peer Service State  HA State with Peer  Reason
      -------------- ------------------  ------------------  --------------
      192.1.1.2      ready               ha-ok               all criteria met

例:

HA ピアでの出力
switch# show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.2)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: ready
    Agent HA Status: ready
    Peers:
      PeerIP         Peer Service State  HA State with Peer  Reason
      -------------- ------------------  ------------------  --------------
      192.1.1.1      ready               ha-ok               all criteria met

ステップ 2

各ピアで HA 整合性チェッカーを実行し NX 構成、状態を Agent の駆動状態、およびトラフィック ディフレクション想定を検証します。

例:

switch# show consistency-checker service-acceleration high-availability
======================================================
PROCESSING HIGH-AVAILABILITY CONSISTENCY CHECK REQUEST
======================================================
****************************************
HA FIREWALL STATE CONSISTENCY
****************************************
  [PASS] Firewall configured and internal states match: in-service
  [PASS] Agent's firewall readiness state matches internal readiness state: ready
  [PASS] Agent's firewall readiness state matches published readiness state: ready
****************************************
FW VLAN OPERATIONAL STATE CONSISTENCY
****************************************
FW L2, L3 VLAN Set Consistency Checks
======================================
  Expected L3 FW VLANs (from VRFs): 656-657,659,755,859
  Expected L2 FW VLANs : 2003,2005
  Expected Combined L2+L3 VLANs: 656-657,659,755,859,2003,2005
  L3 VLAN Comparison:
    [PASS] L3 VLANs match published FW L3 VLANs
  L2 VLAN Comparison:
    [PASS] L2 VLANs match published FW L2 VLANs
  Combined L2+L3 VLAN Comparison:
    [PASS] Combined L2+L3 FW VLANs identified as expected
****************************************
HA PEER CONSISTENCY
****************************************
HA Configuration and Peer State Checks
=======================================
  HA Admin State Comparison:
    [PASS] HA admin state matches with internal state: no-shutdown
  HA Source interface Comparison:
    [PASS] HA Source interface matches: loopback1
  HA Source IP Address Comparison:
    [PASS] HA source IP address matches: 192.1.1.1
  HA Peer Configuration Validation:
    [PASS] Peer 192.1.1.2 found internally.
  HA Peer State Validation:
    [PASS] Internal Peer service state for peer 192.1.1.2 matches service state published by agent: ready
    [PASS] Peer 192.1.1.2 derived firewall state matches: 'ready'
HA VPC Peer Consistency Checks
===============================
  Validating HA Peer Info:
  Internal Peer state validation:
    VPC peer is alive
    [PASS] Peer 192.1.1.2 is being detected as an alive VPC peer
  VPC Peer Firewall State Validation:
    [PASS] Internally known HA VPC peer firewall state is 'ready' (VPC peer exists)
    [PASS] Published HA VPC peer firewall state is 'ready' (VPC peer exists)
VPC State Consistency Checks
=============================
  Validating 4 VPC(s)
  VPC 60 (Po60):
    [Pass] Internal details for VPC 60 matches configuration
    [PASS] VPC 60 is of interest and allows 3 FW l2/l3 VLAN(s): 657,659,2005
  VPC 61 (Po61):
    [Pass] Internal details for VPC 61 matches configuration
    [PASS] VPC 61 is of interest and allows 2 FW l2/l3 VLAN(s): 656,2005
  VPC 62 (Po62):
    [Pass] Internal details for VPC 62 matches configuration
    [PASS] VPC 62 is of interest and allows 2 FW l2/l3 VLAN(s): 755,2003
  VPC 63 (Po63):
    [Pass] Internal details for VPC 63 matches configuration
    [PASS] VPC 63 is of interest and allows 1 FW l2/l3 VLAN(s): 2003
****************************************
HA VRF/VLAN OPERATIONAL STATE CONSISTENCY
****************************************
    [PASS] 2 VRF(s) were validated and are in 'forwarding ready/redirection installed' state
    [PASS] VLANs 2003,2005 were validated and are in 'forwarding ready' state
    [INFO] Both firewalls are ready - proceeding with VRF and VRF-ID validation
    [PASS] All VRF ID validations passed
    [PASS] All VLAN peer consistency checks passed - 2 VLAN(s) validated
=============================================================================================
HIGH-AVAILABILITY CONSISTENCY CHECK COMPLETED - ALL CHECKS PASSED
=============================================================================================

ステップ 3

FW VRF に使用されるカプセル化 VLAN は、両方のピアで一貫している必要があります。これらに一貫性がない場合は、CC がフラグを設定する必要があります。これらの ID は、2 つのスイッチの DPU で一致している必要があり、show service-acceleration redirect-policy brief コマンドを使用して NXOS で表示される値と比較することで確認できます。

例:

switch# slot 1 dpu 1 dpctl hs vrf show-map
VRF Table:
VRF Name                         VRF ID     Internal VRF ID
------------------------------------------------------------
tenant1                          12         4
default                          1          1
tenant2                          13         3
Total VRFs: 3

ステップ 4

Hyper レート エージェントの HA 情報/設定を確認します。

例:

リーダーの Hypershield Agent HA ステータスの出力
switch# service system hypershield connect session /usr/src/app/agwctl ha show
Client got: ok
Data:
=== HA Status ===
Cluster State:   active/active
NX State:        ha-ready
--- Local ---
  Svc State:         ready since 2026-05-12 20:15:48 UTC
    Reason:          all criteria met
    Criteria:        [OK] since 2026-05-12 20:15:48 UTC
      dpu_healthy:   [OK]
      dpu_insync:    [OK]
      in_service:    [OK]
--- Peer: 192.1.1.1 ---
  HA State:               ha-ok since 2026-05-12 22:35:41 UTC
    Reason:               all criteria met
  Svc State:              ready since 2026-05-12 22:35:40 UTC
    Reason:               peer service ready
    Criteria:             [OK] since 2026-05-12 22:35:40 UTC
      peer_service:       [OK]
  Membership:             [OK] since 2026-05-12 23:52:45 UTC
    peer_compatible:      [OK]
    peer_dpu_keepalive:   [OK]
    peer_vrf_gid:         [OK]
  Adjacency:              [OK] since 2026-05-12 22:35:10 UTC
    peer_dpu_bulk_sync:   [OK]
    peer_policy:          [OK]

例:

準備ができているリーダーの Hypershield Agent HA ピア ステータスの出力
switch# service system hypershield connect session /usr/src/app/agwctl ha peers show
Client got: ok
Data: 
=== HA Peers ===
--- Peer: 192.1.1.1 ---
HA State:        ha-ok since 2026-05-12 22:35:41 UTC
  Reason:        all criteria met
Svc State:       ready since 2026-05-12 22:35:40 UTC
  Reason:        peer service ready
IpConfigState:   success
Connected:       [OK] since 2026-05-12 23:57:40 UTC
Service Criteria Met:   [OK] since 2026-05-12 22:35:40 UTC
  peer_service:         [OK]
Member Criteria Met:    [OK] since 2026-05-12 23:57:44 UTC
  peer_compatible:      [OK]
  peer_dpu_keepalive:   [OK]
  peer_vrf_gid:         [OK]
Adjacency Criteria Met:   [OK] since 2026-05-12 22:35:10 UTC
  peer_dpu_bulk_sync:     [OK]
  peer_policy:            [OK]
Member Info:
  Serial:              FDO28370FGQ
  Model:               N9324C-SE1U
  SW Version:          10.6(3q)ISQ9(0.13)
  CPA Version:         v1.19.0-pre.8-151-g14b22c12
  Reported HA State:   ha-ready
  Service:             ready
  LB Mode:             symmetric-hash
  Policy Rev:          
  Policy Check:        false
  DPUs:                dpu2(1.150.2), dpu4(1.150.2), dpu1(1.150.2), dpu3(1.150.2)
DPU HA Status:
  dpu1:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu2:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu3:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu4:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]

ステップ 5

準備ができたフォロワーの Hypershield Agent HA ステータスを確認します。

例:

switch# service system hypershield connect session /usr/src/app/agwctl ha show
Client got: ok
Data:
=== HA Status ===
Cluster State:   active/active
NX State:        ha-ready
--- Local ---
  Svc State:         ready since 2026-05-12 20:15:48 UTC
    Reason:          all criteria met
    Criteria:        [OK] since 2026-05-12 20:15:48 UTC
      dpu_healthy:   [OK]
      dpu_insync:    [OK]
      in_service:    [OK]
--- Peer: 192.1.1.1 ---
  HA State:               ha-ok since 2026-05-12 22:35:41 UTC
    Reason:               all criteria met
  Svc State:              ready since 2026-05-12 22:35:40 UTC
    Reason:               peer service ready
    Criteria:             [OK] since 2026-05-12 22:35:40 UTC
      peer_service:       [OK]
  Membership:             [OK] since 2026-05-12 23:52:45 UTC
    peer_compatible:      [OK]
    peer_dpu_keepalive:   [OK]
    peer_vrf_gid:         [OK]
  Adjacency:              [OK] since 2026-05-12 22:35:10 UTC
    peer_dpu_bulk_sync:   [OK]
    peer_policy:          [OK]

ステップ 6

準備ができているピアの Hypershield Agent HA ピアのステータスを確認します。

例:

switch3# service system hypershield connect session /usr/src/app/agwctl ha peers show
Client got: ok
Data:
=== HA Peers ===
--- Peer: 192.1.1.2 ---
HA State:        ha-ok since 2026-05-12 22:35:20 UTC
  Reason:        all criteria met  --> Both peers are ready and sync is completed – HA is ready
Svc State:       ready since 2026-05-12 20:15:28 UTC
  Reason:        peer service ready
IpConfigState:   success
Connected:       [OK] since 2026-05-12 23:55:54 UTC
Service Criteria Met:   [OK] since 2026-05-12 20:15:28 UTC
  peer_service:         [OK]
Member Criteria Met:    [OK] since 2026-05-12 23:55:55 UTC
  peer_compatible:      [OK]
  peer_dpu_keepalive:   [OK]
  peer_vrf_gid:         [OK]
Adjacency Criteria Met:   [OK] since 2026-05-12 22:34:50 UTC
  peer_dpu_bulk_sync:     [OK]
  peer_policy:            [OK]
Member Info:
  Serial:              FDO28370FGZ
  Model:               N9324C-SE1U
  SW Version:          10.6(3q)ISQ9(0.13)
  CPA Version:         v1.19.0-pre.8-151-g14b22c12
  Reported HA State:   ha-ready
  Service:             ready
  LB Mode:             symmetric-hash
  Policy Rev:
  Policy Check:        false
  DPUs:                dpu2(1.150.2), dpu4(1.150.2), dpu1(1.150.2), dpu3(1.150.2)
DPU HA Status:
  dpu1:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu2:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu3:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]
  dpu4:   keepalive=[OK]  bulk_sync_local=[OK]  bulk_sync_peer=[OK]

メンバーシップの障害

メンバーシップの障害は、スイッチオーバー/テイクオーバー シナリオをトリガー可能性があり、結果として、DPU キープアライブの障害、バージョンとプラットフォームの不一致、負荷分散モードの不一致が発生する可能性があります。

両方のスイッチが FW レディの場合、リーダーがトラフィックを引き継ぎ、フォロワーは 準備ができていないに移行します。

トラフィック回避メカニズムは、 インサービス 中にファイアウォールが 準備ができていないに移行すると有効になります。

手順

ステップ 1

リーダーとして選択されたピアがトラフィックを引き継ぎ、フォロワーはローカル状態を準備ができていないとして移行します。

例:

switch# show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.1)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: not-ready     --> not ready 
    Agent HA Status: switchover                      --> switched to peer
    Peers:
      PeerIP              Peer Service State  HA State with Peer  Reason
      ------------------- ------------------  ------------------  --------------
      192.1.1.2           ready               ha-fail             membership failure: peer_compatible
switch# show service-acceleration high-availability status
  Service System: hypershield
    HA Source Interface: loopback1 (192.1.1.2)
    HA Admin State: no-shutdown
    Agent Status for Service Firewall: ready     --> ready
    Agent HA Status: takeover                    --> takes over from peer
    Peers:
      PeerIP              Peer Service State  HA State with Peer  Reason
      ------------------- ------------------  ------------------  --------------
      192.1.1.1           not-ready           ha-fail             membership failure: peer_compatible

ステップ 2

このコマンドを使用して、互換性障害の原因を特定します。

例:

switch# service system hypershield connect session /usr/src/app/agwctl ha compatibility
Client got: ok
Data:
=== HA Compatibility ===
--- Peer: 192.1.1.1 ---
Membership:
Field          Local                         Peer                          Status
model          N9324C-SE1U                   N9324C-SE1U                   [OK]
nxos_version   10.6(3q)ISQ9(0.13)            10.6(3q)ISQ9(0.13)            [OK]
cpa_version    v1.19.0-pre.8-151-g14b22c12   v1.19.0-pre.8-151-g14b22c12   [OK]
dpu_count      4                             4                             [OK]
lb_mode        symmetric-hash                pinning                       [FAIL]
policy_check   false                         false                         [OK]
dpu:dpu1       1.150.2                       1.150.2                       [OK]
dpu:dpu2       1.150.2                       1.150.2                       [OK]
dpu:dpu3       1.150.2                       1.150.2                       [OK]
dpu:dpu4       1.150.2                       1.150.2                       [OK]
Verdict: [FAIL]
Adjacency:
Field             Local   Peer   Status
policy_revision                  [OK]
Verdict: [OK]

ステップ 3

VRF がリダイレクション インストール済み または 隔離 状態に移行し、 VRF 分離が有効になることを確認します。vPC トラフィック偏差も有効になります。

例:

switch# show service-acceleration status details
  Service System: hypershield
    Source Interface: loopback2 (10.29.251.101)
    DPU Load-balance Mode: pinning
    Agent Status: firewall-ready,redirect-installed
    Agent Health Status: ok
    Controller Connection Status: init
    Agent HA Status: switchover
    Services:
      Firewall: in-service
      VRF                              Operational State       Affinity(DPU)
      ======================================================================
      tenant1                          redirection installed   1
      tenant2                          redirection installed   2
      VLAN                             Operational State       Affinity(DPU)
      ======================================================================
      2003                             forwarding ready        1
      2005                             forwarding ready        3

ステップ 4

スイッチオーバーまたはテイクオーバー時に Hypershield Agent の HA ステータスを確認します。

例:

switch# service system hypershield connect session /usr/src/app/agwctl ha show
Client got: ok
Data:
=== HA Status ===
Cluster State:   active/standby (degraded)
NX State:        ha-takeover
--- Local ---
  Svc State:         ready since 2026-05-12 20:15:48 UTC
    Reason:          all criteria met
    Criteria:        [OK] since 2026-05-12 20:15:48 UTC
      dpu_healthy:   [OK]
      dpu_insync:    [OK]
      in_service:    [OK]
--- Peer: 192.1.1.1 ---
  HA State:               ha-fail since 2026-05-13 00:30:34 UTC
    Reason:               membership failure: peer_compatible
  Svc State:              not-ready since 2026-05-13 00:30:17 UTC
    Reason:               peer service not-ready
    Criteria:             [FAIL] since 2026-05-13 00:30:17 UTC
      peer_service:       [FAIL]
  Membership:             [FAIL] since 2026-05-13 00:30:20 UTC
    peer_compatible:      [FAIL]
    peer_dpu_keepalive:   [OK]
    peer_vrf_gid:         [OK]
  Adjacency:              [FAIL] since 2026-05-13 00:30:24 UTC
    peer_dpu_bulk_sync:   [FAIL]
    peer_policy:          [OK]