how to disconnect and relocate ESA in Cluster

[hashimwajid1]

 Hi 

we have 2 x C190 ESA configured in Cluster. i want to shift 1 x ESA from one rack to another Rack in same data center. 

my question is if i shut the ESA and after relocation then again power on the ESA, will it automatically join the ESA or will it have impact on Cluster ? 

do i need to reconfigure the cluster config again ? 

[Ken Stieers]

As long as you don't change IPs, shutting it down, moving it, powering it up won't have any effect.



You DO want to suspend the listeners, make sure it delivers all mail in its workqueue, THEN shut it down.

After you move it and power it up, just resume the listeners, and you'll be back in business...

[hashimwajid1]

Hi Ken

thanks for your comment. 

is it compulsory to Suspend the listener ?

I will follow the below procedure. please correct me if i am wrong.

1- power off the 1 x ESA ( i will take backup before shutting down ) 

2- reconnect and power on again 

3- during this procedure my Email flow will will not be impacted ?

is there any way to verify that both ESA are part of the cluster and cluster is working fine once i will power on second ESA ?

[Ken Stieers]

Not compulsory, but you're taking a risk you really don't need to take.

You can corrupt the workqueue if you shut it down in the middle of receiving an email.

[hashimwajid1]

so what should be the best way to disconnect and reconnect again ?

actually one ESA is not mounted yet. its just kept on top of one of the device. so now i have to mount it but my problem it is in cluster. can u tell me the right steps ?

[Ken Stieers · Accepted solution]

nothing special to do if its in a cluster.

Assuming the ESA is currently up and running and moving email, you do the same thing whether its clustered or not.

Login to CLI.

Run the "suspendlistener' command and select "All" from the menu

run Shutdown

Once it powers off, unplug it, move it, wire it up again.

Power it on

login to cli

Run "ResumeListener" select all...

done

[hashimwajid1]

thanks for your reply
one query regarding above points.
1- if i dont disable listener then there is risk involve ?
2- i will have to access the cli of particular ESA and there i will disable the listner and meanwhile other ESA will keep working.

[Robert Sherwin · Accepted solution]

1. If you do not suspend the listener, the risk you run is mail continues to move in/out to the appliance that you may be shutting down.  Improper shutdown of mail "not parked" may lead to queue issues.  Recommendation when powering down would be

2. Correct.  Access CLI of the ESA, issue "suspendlistener", wait the time period (30 seconds), then proceed with shutdown, move, etc.  The listener on the 2nd ESA is independent and will continue to work, process mail.  Once you are done w/ the move of the 1st ESA, power it back on... and from CLI just issue "resume".  Mail will then resume processing on that appliance as well.  One thing to then run is just "clustercheck" to assure that it has indeed run through the cluster sync and communicates w/ ESA #2.

[hashimwajid1]

thanks for support,

i successfully relocated the ESA and now cluster is working fine. but i received one error message 

Unable to connect to Cisco Web Security Service.

URL Filtering will not work correctly.

Please verify all network, proxy and firewall settings.

Connection to "v2.sds.cisco.com" failed.

The last error seen on this connection: "Authentication failure. Please check client certificate"

even all email flowing properly but the question is why it showed this error message. 

is it IOS bug ?

URL filtering is disable in ESA 

Asyncos verion is 10.0.2-020

ESA model is C190 

[Robert Sherwin]

No, this is not a bug. If you can, from the CLI run “ecupdate force”.

You should be able to “telnet v2.sds.cisco.com 443” and get a connection.

For all services on the ESA, you can issue “updatenow force” to have everything pull the current updates.

And, since you have mentioned SDS --- PLEASE make sure that you have the following field notice implemented: https://www.cisco.com/c/en/us/support/docs/field-notices/641/fn64111.html

[hashimwajid1]

thanks Robert
does this error message has any impact on our current services. we received this message only one time when we powered on the device and now its been 7 hours and this message not appear again.

[Robert Sherwin]

No, no impact. Most likely if this was @ time of power-up, then the ESA just had not established proper communication prior mail processing. Usually one-time alerts, especially at power-up/reboot, can be safely ignored. As long as you run the “updatenow force” and “tail updater_logs”, and you see the updates reach out, connect, update, then you are good to go.

[hashimwajid1]

Thanks Robert and Kein 

your comments were very useful