Monitoring EFW Status
41
Typical situations that require manual synchronization include:
■
Restarting a Policy Server
—If a Policy Server is offline and you bring it back online,
the Policy Server should automatically re-synchronize with its domain. If it cannot, a
dialog window appears asking which Policy Server to use as the “master” for re-
synchronization (that is, the Policy Servers both accept one of the databases as the
correct one).
■
Policy Server out of synchronization while running
—The system reports on
synchronization status in the information window for each Policy Server. If you notice a
Check Synchronization
message at the bottom of the Management Console window,
click on each Policy Server in the tree to display its information window and check the
status. If a Policy Server has a status of
Not Responding
(usually
due to a network
problem), when this problem clears it may display a status of
Out of Synchronization
.
Usually, the system is able to re-synchronize automatically at this point. However, if the
Out of Synchronization
status persists for longer than several minutes, you will need to
restart that Policy Server and manually re-synchronize the Policy Servers by entering a
“master” server in the dialog window that appears during the restart.
Monitoring EFW Device Status and Missed Heartbeats
You can view the status of EFW devices through the Management Console. A heartbeat is
a short message which informs the Policy Server that the EFW device is operational. It also
contains information on the policy that the EFW device is implementing, the EFW device’s
IP address, and the backup Policy Server cached by the embedded firewall. Heartbeat
intervals are assigned to device sets rather than individual EFW devices. All EFW devices in
a device set have the same heartbeat interval. When the Policy Server receives a heartbeat
from an EFW device, it cryptographically verifies the sender and checks the provided
information for currency. The Policy Server responds with updated information to the EFW
device, if needed.
A
wake-up
is a short message that alerts the Policy Server when a significant event
happens on the EFW device’s host machine (the most common event that causes a wake-
up is if the host machine is booted). The heartbeat interval for an EFW device resets itself
each time a wake-up is sent.
The EFW device window provides information received when EFW devices make first
contact with a Policy Server, as well as any heartbeats that you have configured.
The window shows the last time that a heartbeat was received from an EFW device.
You can use
Find
->
Device
->
Missed Heartbeat
to get a list of NICs that have failed
to send a wake-up or heartbeat at the specified heartbeat interval (plus a three-minute
grace period).
NOTE:
When you select a master in the synchronization dialog, any new data on the
Policy Server that is not selected as the master is lost. However, if an EFW device is
lost from the database, it automatically re-registers itself in the database the next
time it attempts to contact a Policy Server (on next wake-up or heartbeat). The EFW
device is placed in the default device set and needs to be manually moved if it
requires a policy other than that assigned to this device set.
NOTE:
If you do not respond to the master dialog window, it times out and the
Policy Server starts up with the previous data. Replication does not occur to or
from this Policy Server. To regain replication in this scenario, you must restart the
Policy Server.
