I've been having an e-mail conversation with one of my customers and I'd like to seek clarification on some points.
The customer has a pair of S3008 appliances running 8.3.0 in an active/passive (peer-to-peer) HA cluster. He is looking at the process of upgrading and the correct procedure for doing so.
Basically everythig he has proposed is correct - upgrade Firewall B to 8.3.1 (the domant member), perform a failover to bring it online (making Firewall A domant), check to make sure the new version of software doesn't cause any issues, upgrade Firewall A to the same version and (optionally) forcing another HA event to make A the active member once again. He then posed some questions which I answered to his satisfaction. He did, however, ask two which I wasn't immediately sure of:-
If B is primary, and changes made will A sync to primary once upgraded & rebooted?
What I was absolutely certain of was that while the two appliances were running different versions that changes made to the active member wouldn't be synchronized to the passive member. However, I wasn't 100% sure if once the other applince was upgraded to the same version whether is would definitely inherit any changes made in the interim.
With different versions it will still do a graceful handover on scheduled shutdown/reboot? Where transfer of connection starts 30 mins prior to shutdown/reboot.
This, oddly, isn't something I've conciously tried. I've pulled network cables, power cables and such like to force a failover, but am not 100% sure if a scheduled reboot of the active member would allow the other member to still take over 'gracefully' while there is still a disparity between the two software versions. I'm again assuming that it will be "yes" as there will still be a functioning channel of communication over the HA link and even though there's temporary minor difference between the two appliances, there's still enough compatibility between the two for one to let the other know that it needs to take over, rather than waiting for some kind of actual failure event where the secondary box suddenly realises that it is no longer able to communicate with the primary.