D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 415 / 469

Creating an object is mandatory for an interface pair used for remote management, but optional
for other interfaces (in which case the default address localhost must be used which is an IP
from the 127.0.0.0/8 subnet).
8. Go to Interfaces > Ethernet and go through each interface in the list, entering the shared IP
address for that interface in the IP Address field.
Also select the Advanced tab for each interface and set the High Availability, Private IP
Address field to be the name of the IP4 HA Address object created previously for the interface
(NetDefendOS will automatically select the appropriate address from the master and slave
addresses defined in the object).
Note
The term private IP address is not strictly correct when used here. Either address
used in an IP4 HA Address object may be public if management access across the
public Internet is required.
9. Save and activate the new configuration.
10. Repeat the above steps for the other D-Link Firewall but this time select the node type to be
Slave.
Making Cluster Configuration Changes
The configuration on both D-Link Firewalls needs to be the same. The configurations of the two
units will be automatically synchronized. To change something in a cluster configuration, log on to
either the master or the slave, make the change, then save and activate. The change is automatically
made to both units.
11.3.3. Verifying the Cluster is Functioning
To verify that the cluster is performing correctly, first use the ha command on each unit. The output
will look similar to the following for the master:
gw-world:/> ha
This device is an HA MASTER
This device is currently ACTIVE (will forward traffic)
HA cluster peer is ALIVE
Then use the stat command to verify that both the master and slave have about the same number of
connections. The output from the command should contain a line similar to the following:
Connections 2726 out of 128000
The lower number on the left in this output is the current number of connections and the higher
number on the right is the maximum number of connections allowed by the license.
The following points are also relevant to cluster setup:
• If this is not the first cluster in a network then the Cluster ID must be changed for the cluster so
that it is unique (the default value is 0). The Cluster ID determines that the MAC address for the
cluster is unique.
• Enabling the advanced setting Use Unique Share MAC is recommended so that each interface
has its own MAC address. If this is not enabled, interfaces share a MAC address and this can
confuse some third party switches.
11.3.3. Verifying the Cluster is
Functioning Chapter 11. High Availability
415