Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 512 / 861

511 High availability and load balancing using clusters
How clusters work
The heartbeat network uses five ports for clustering. When configuring the cluster, the wizard asks for
a starting port, and then chooses the next four consecutive ports for the five used. Ensure that you
have not picked a starting port that overlaps another port in use. The selected port is not enforced,
therefore, if another service is operating on the selected or derived port, there may be conflicts.
Note: Do not enable intrusion detection and prevention (IDS/IPS) on the heartbeat network. This
degrades the performance of both the cluster and the security gateway.
Cluster prerequisites
Every security gateway that you add to a cluster must meet the following prerequisites:
■
All clusters must be composed from the same hardware model family:
■
All members must have the same number of configured interfaces with the same case-sensitive
logical names.
■
All members must be running on the same operating system. You cannot mix platforms; if you
have a Microsoft Windows or Sun Solaris security gateway, you need to backup your configuration
and migrate to a Symantec Gateway Security 5600 Series v3.0 prior to adding it to a cluster.
■
The network configuration of all cluster members must match; the IP addresses of all cluster
members must be on the same subnets.
■
Each cluster member must have a unique member ID. The member ID is the last octet in the IP
address.
■
All members must be in the same time zone. To specify the time zone, run the System Setup
Wizard.
■
Each security gateway must have a different system name.
■
All cluster members must have identical licensed features.
■
All cluster members must belong to the same domain.
■
No cluster member can be a member of another cluster.
■
Contact your network administrator for the virtual IP addresses (VIPs) that you will associate with
the cluster interfaces.
■
If the security gateways include redirected services, disable those services.
After you create the cluster, replace the system address in each redirected service with a VIP
address and re-enable the services.
■
If there are pending changes on any of the security gateways, other than the cluster member that is
deploying the configuration, either activate them or discard them.
This allows the automatic creation of a backup configuration for use if you delete the cluster
member from the cluster.
■
Ensure that all security gateways that you intent to add to the cluster are up and running, and that
there are no active administrator sessions to these security gateways.
Table 14-1 Symantec Gateway Security hardware model families
Family Model numbers
4400
4420, 4460
5400
5420, 5440, 5460
5600
5620, 5640, 5660