Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 511 / 861

510 High availability and load balancing using clusters
How clusters work
Virtual IP addresses and VIP owners
Symantec’s cluster implementation uses virtual IP addresses (VIPs) to direct traffic. With VIPs, all
cluster members share the same virtual IP addresses for a given subnet, although only one member can
physically own the VIP at a time. When network traffic occurs, all hosts point to the VIP and not the
real IP address of a cluster member. The traffic is routed to the cluster member that currently owns the
VIP.
The security gateway makes use of two types of VIPS: cluster VIPs, which are used to share all manner
of gateway services, and service VIPs which are optional and associated with specific redirected
services that you may configured on the security gateway. Cluster VIPs are configured in the Cluster
Wizard and are essential to cluster operation. Most of the discussion of VIPs in this chapter refers to
cluster VIPs.
When a VIP is created, an adapter entry is placed in the routing table of each cluster member. Unlike
physical network adapter records, the virtual adapter record on each cluster member can and does
contain the same IP address.
Each security gateway in the cluster shares the same VIP for a given subnet, and is viewed as a
potential candidate to receive packets. If one security gateway becomes unavailable, another security
gateway can assume control and handle any new requests, providing continued connectivity to your
network. All of this is done without having to change or reassign default gateways on any computers.
All hosts point to the local default gateway, and not the real IP address of a given cluster member.
Because the VIP is assigned to a subnet, all of the cluster members on that subnet have the same virtual
adapter. With load balancing configured, the cluster spreads out the connections more evenly over
several different machines instead of always sending requests to one machine.
Only one cluster member can physically own the VIP, and is referred to as a VIP owner.
Authoritative cluster member
The authoritative cluster member decides which cluster member handles a packet. If the selected
cluster member is able to handle the packet, that cluster member becomes the owner for all packets in
that connection. If the selected cluster member is unable to handle a new connection, possibly due to
high load, the packet is assigned to another cluster member until accepted.
Heartbeat network
The heartbeat network is the subnet that the cluster uses to share state information.
You use the Cluster Wizard to define the heartbeat interface attribute. You must specify the heartbeat
interface only once for the cluster. The Cluster Wizard then automatically sets the heartbeat interface
attribute for each new cluster member, assuming that the logical name and subnet must be the same as
the heartbeat interface of the other cluster members.
Note: Traffic on the heartbeat network is not encrypted. You should choose a private (dedicated)
network as the heartbeat, and separate the heartbeat network from any other protected network to
keep traffic to a minimum.
Note: NIC monitoring does not work if you use crossover cables in a heartbeat network.