Cold standby hardware & replacement procedures

Last modified on 4 Oct, 2022. Revision 15
Clavister offers an extended RMA service called "Cold Standby" (CSB) which can minimize downtime when there is a hardware issue. This allows a customer to have a standby unit on site which can be used to immediately replace faulty hardware.
Status OK

CSB Restrictions

  • CSB units must match the hardware model of the original unit. For example, a NetWall E10 CSB can only replace another NetWall E10, but it could be one of many E10s.
  • CSB units cannot be used as a slave node in a High Availability cluster. HA clusters must contain two standard units with active licenses.
  • CSB units are not intended to be used as a standard non-CSB unit since they are set up to only run with the license from the unit they replace.

CSB Video Guide

How a Cold Standby swap works and how to request an RMA for the original faulty unit is shown in the following video: CSB-Swap_.mp4

CSB Documentation

The CSB service and the CSB replacement process for NetWall hardware is fully described in the “Cold Standby Service” chapter of the PDF entitled “Hardware Replacement Guide for NetWall Firewalls”. This is part of the documentation package for each cOS Core release.

CSB on firewalls with subscryption based licenses (MSSP / SecAAS)

For firewalls using subscription based licenses the procedure is the same but there is an additional factor that we need to take into account. That extra factor is when the license swap is performed, should the old firewall still be semi-alive it would detect a license update at it’s next update check and download a license that would result in lockdown.

To avoid this, do not perform the CSB swap until you are ready to replace the actual unit. Or time the swap with the next license update, you can see the status of the update check timer using the CLI command “license”, the update check is performed every 4’th hour. Example output:

SECaaS Call-Home Status
----------------------------
SECaaS System Identifier:    xx-xx-xx-xx-xx-xx
SECaaS Registration Key:     xxxx-xxxx-xxxx-xxxx
Firewall status              Running normally
Last Reached:                2022-10-03 07:11:23
Last Attempt:                2022-10-03 07:11:23
Next Attempt:                03:39:47 (HH:MM:SS)
Last Result:                 License validated by HA peer
Reason of Last Call:         Call-Home Service



Related articles

E20A BIOS update
15 Sep, 2022 hardware bios e20
Moving configurations between dissimilar NetWall hardware
1 Feb, 2023 core wizard hardware migration netwall
Differences between the NetWall E80A and E80B
31 May, 2021 hardware ha e80a e80b
Clavister SFP/SFP+ module compatibility
7 Feb, 2024 core sfp gbic hardware