HA pair behaviour during switch upgrade

[cmr]

One of our sites today that uses Cisco IOS switches in a stack is having the firmware upgraded.  The reboot process takes 10-15 minutes and during this the Meraki SD-WAN goes bonkers due to no LAN connections

I know this is a known issue but the only solution I can think of is to have a direct connection between the MXs, either on the LAN (the old preferred method) or WAN if NoNAT is enabled.  I'm not even sure that the latter would work, but the documentation does state that the WAN cannot be used for VRRP due to the NAT component... 

Does anyone have any experience of this?

[ww]

i dont know.

But Is this a problem if  your  LAN is down  anyway?  Cant you  poweroff  1 mx? Or disable  autovpn?

[cmr]

It's more of an annoyance as yes, the LAN is down, than a real issue but I didn't appreciate the 150+ emails I got in the 10 minutes of downtime...  Disabling AutoVPN could be an option, I hadn't thought of that, but powering one MX off isn't as I'm a couple of hundred miles away!

[DensyoV · Accepted solution]

Hi,

If you are only concern about the email alerts, then perhaps you can just temporarily disable it instead of turning off the VPN. The problem with turning off the VPN, if you are just using auto for the NAT traversal, its UDP port may change once you re-enable the VPN again and if there is a FW upstream, it may drop the packet if it sees a different UDP port or if it unable to clear the previous UDP flow.

hope this helps.