D-Link NetDefend DFL-1660, User Manual

Page: 536 / 595

2. Go to: System > High Availability.
3. Check the Enable High Availability checkbox.
4. Set the Cluster ID. This must be unique for each cluster.
5. Choose the Sync Interface.
6. Select the node type to be Master.
7. Go to: Objects > Address Book and create an IP4 HA Address object for each interface pair.
Each must contain the master and slave interface IP addresses for the pair.
Creating an object is mandatory for an interface pair used for remote management, but optional
for other interfaces (in which case the default loopback address localhost must be used and this
is an IP address from the 127.0.0.0/8 sub-network).
8. Go to: Interfaces > Ethernet and go through each interface in the list, entering the shared IP
address for that interface in the IP Address field.
Also select the Advanced tab for each interface and set the High Availability, Private IP
Address field to be the name of the IP4 HA Address object created previously for the interface
(NetDefendOS will automatically select the appropriate address from the master and slave
addresses defined in the object).
Note: IP addresses could be public IPv4 addresses
The term "private IPv4 address" is not strictly correct when used here. Either
address used in an IP4 HA Address object may be public if management access
across the public Internet is required.
9. Save and activate the new configuration.
10. Repeat the above steps for the other NetDefend Firewall but this time select the node type to be
Slave.
Making Cluster Configuration Changes
The configuration on both NetDefend Firewalls needs to be the same. The configurations of the two
units will be automatically synchronized. To change something in a cluster configuration, log on to
either the master or the slave, make the change, then save and activate. The change is automatically
made to both units.
11.3.3. Verifying the Cluster Functions
To verify that the cluster is performing correctly, first use the ha command on each unit. The output
will look similar to the following for the master:
gw-world:/> ha
This device is an HA MASTER
This device is currently ACTIVE (will forward traffic)
HA cluster peer is ALIVE
Then use the stat command to verify that both the master and slave have about the same number of
connections. The output from the command should contain a line similar to the following:
Connections 2726 out of 128000
11.3.3. Verifying the Cluster Functions Chapter 11. High Availability
536