Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 531 / 861

530 High availability and load balancing using clusters
Cluster interactions with other security gateway features
Related information
None.
Cluster interactions with other security gateway features
When you create clusters, be aware of how clustering affects the following security gateway features:
Modifying redirected services for clustering
Redirected services let you redirect a request for a service to a computer behind the security gateway
without publishing the actual destination address. Understand that the steps taken to create redirected
services for a cluster only apply to using the gateway address (physical IP address in a non-cluster
environment) or cluster address (VIP in cluster environment) as the redirected address.
If a security gateway includes redirected services, disable all redirected services. After you create the
cluster, replace the system address in each redirected service with a VIP address and re-enable the
services. The VIP address can be a cluster VIP address, previously configured in the Cluster Wizard. Or,
it can be a service VIP, which is any address distinct from cluster VIPs and gateway interface
addresses, and is otherwise available for dedicated use. A service VIP requires no additional steps for
configuration, other than to declare it in the redirected service property dialog box.
For example, a redirected service is configured if you use the System Setup Wizard to configure the
SMTP mail service. The resulting redirected service receives traffic on the outside interface of the
security gateway and redirects it to your mail server.
When the HTTP redirected service is used on a security gateway that is not in a cluster, the requested
address is often the actual IP address of the security gateway’s outside interface. In a clustered
environment, this IP address must be replaced by a VIP to enable load balancing and high availability.
This means that as you modify a cluster by adding or removing security gateways, you must edit
redirected services to prevent conflicts.
You modify redirected services for clustering differently in the following situations.
Redirected services See “Modifying redirected services for clustering” on page 530.
Use of the RIP protocol See “Modifying the RIP daemon for use with clusters” on page 533.
Use of hot standby mode with VPN tunnels
and hotfixes See “Using hot standby mode” on page 533.
Gateway-to-gateway tunnels that use NAT See “Configuring gateway-to-gateway VPN tunnels that use NAT” on
page 534.
When you add a security gateway with a redirected
service to a cluster.
You make the same modifications if you are creating a
cluster or adding the security gateway after the
cluster is created.
See “To add a security gateway with a redirected service to a
cluster” on page 531.
When you delete a security gateway from a cluster
and want it to use the cluster’s configuration, which
contains a redirected service. See “To remove a cluster member that has a redirected
service” on page 531.
When you remove a cluster and want the security
gateway to use the cluster’s configuration, which
contains a redirected service. See “To remove a cluster whose configuration has a
redirected service” on page 532.