Cold standby hardware & replacement procedures

CSB Restrictions

• CSB units must match the hardware model of the original unit. For example, a NetWall E10 CSB can only replace another NetWall E10, but it could be one of many E10s.
• CSB units cannot be used as a slave node in a High Availability cluster. HA clusters must contain two standard units with active licenses.
• CSB units are not intended to be used as a standard non-CSB unit since they are set up to only run with the license from the unit they replace.

CSB Video Guide

How a Cold Standby swap works and how to request an RMA for the original faulty unit is shown in the following video: CSB-Swap_.mp4

CSB Documentation

The CSB service and the CSB replacement process for NetWall hardware is fully described in the “Cold Standby Service” chapter of the PDF entitled “Hardware Replacement Guide for NetWall Firewalls”. This is part of the documentation package for each cOS Core release.

CSB on firewalls with subscryption based licenses (MSSP / SecAAS)

For firewalls using subscription based licenses the procedure is the same but there is an additional factor that we need to take into account. That extra factor is when the license swap is performed, should the old firewall still be semi-alive it would detect a license update at it’s next update check and download a license that would result in lockdown.

To avoid this, do not perform the CSB swap until you are ready to replace the actual unit. Or time the swap with the next license update, you can see the status of the update check timer using the CLI command “license”, the update check is performed every 4’th hour. Example output:

SECaaS Call-Home Status
----------------------------
SECaaS System Identifier:    xx-xx-xx-xx-xx-xx
SECaaS Registration Key:     xxxx-xxxx-xxxx-xxxx
Firewall status              Running normally
Last Reached:                2022-10-03 07:11:23
Last Attempt:                2022-10-03 07:11:23
Next Attempt:                03:39:47 (HH:MM:SS)
Last Result:                 License validated by HA peer
Reason of Last Call:         Call-Home Service

Related articles