9
High Availability
158
Interfaces
that
are
not
set
as
critical
in
the
configuration
do
not
have
heartbeats
sent
over
them
and
will
not
cause
an
HA
failover
if
they
fail.
Failure
of
a
critical
interface
will
cause
a
failover
to
occur
once
the
cluster
has
identified
the
failed
interface.
The
heartbeat
mechanism
is
discussed
in
more
depth
later
in
Section
14.2,
“HA
Mechanisms”
.
Cluster management
When
managing
the
individual
hardware
units
in
a
cluster,
you
must
administer
them
separately
using
management
interfaces.
Configuration
changes
are
not
automatically
duplicated
between
the
cluster
peers
unless
the
advanced
setting
AutoSyncCfg
is
enabled.
It
is
possible
to
use
the
following
command
to
manually
send
the
configuration
to
the
other
cluster
peer:
Device:/>
ha
‐
sendconf
To
manually
have
one
peer
retrieve
the
configuration
from
the
other
cluster
peer,
use
the
command:
Device:/>
ha
‐
recvconf
Load-sharing
SEG
HA
clusters
do
not
provide
load
‐
sharing
since
only
one
unit
will
be
active
at
a
time,
and
only
two
security
gateways,
the
master
and
the
slave,
can
exist
in
a
single
cluster.
The
only
processing
role
that
the
inactive
unit
plays
is
to
replicate
the
state
of
the
active
unit
and
to
take
over
all
traffic
processing
after
a
failover
if
it
determines
the
active
unit
has
experienced
a
failure.
Hardware duplication
SEG
HA
will
operate
only
between
two
security
gateways.
As
the
internal
operation
of
different
security
gateway
manufacturer's
software
is
completely
dissimilar,
there
is
no
common
method
available
to
communicating
state
information
to
a
dissimilar
device.
It
is
also
strongly
recommended
that
the
security
gateways
used
in
cluster
have
identical
configurations.
Where
applicable,
they
must
also
have
identical
licenses
that
allow
identical
capabilities
including
the
ability
to
run
in
an
HA
cluster.
With
the
SEG
‐
100
module,
which
has
two
individual
security
gateways
on
one
blade
(
DPB1
and
DPB2
),
it
is
not
recommended
to
have
the
module
be
a
self
‐
contained
cluster.
Instead,
the
corresponding
processor
on
a
separate
SEG
‐
100
should
be
the
cluster
peer.
In
other
words,
the
DPB1
processor
on
one
module
should
be
the
peer
to
the
DPB1
processor
on
another,
identical
module.
The
two
blades
are
typically
in
the
same
chassis
and
use
the
chassis
backplane
to
communicate.
