Starting and Stopping System Components
25
Joining a New Policy Server to a Domain
To join a new Policy Server to a domain, follow the steps below.
1
If you are starting the Policy Server for the first time, the Join Existing EFW Domain or
Create EFW Domain window appears. In this window, you may revise the domain
choices you made during the installation, if desired.
2
Select the host name or IP address for the new Policy Server from the list displayed.
The name selected here is used by the system for three purposes:
■
It is the default displayed in the Management Console as the name of this
Policy Server.
■
It determines the network address used by all embedded firewalls in this EFW
domain to contact the Policy Server. If the host name is selected, the NICs are given
the IP address obtained when the Policy Server host converts this host name to an
IP address.
■
It is the network address used by all other Policy Servers in this domain, to contact
this Policy Server. If the host name is selected, it is used as is, with no conversion to
IP address for this purpose.
Selecting either the host name or IP address results in a successful installation if all
EFW NICs and all NICs on all Policy Server hosts in your EFW domain reside on one
network. Use the following additional guidelines to determine whether to use an IP
address or host name:
IP address:
The IP address works successfully in the broadest range of network
configurations. Selecting an IP address has the advantage of avoiding impact on your
EFW system due to DNS name changes. It is less attractive for display purposes than
the host name, but a user can modify the displayed name at any time without
affecting system connectivity.
If you choose an IP address, select one such that
■
any NICs that belong to this EFW domain can resolve this address, and
■
traffic originating at the Policy Server machine and going to the EFW NICs in
this domain is routed through the network card on the Policy Server machine
corresponding to this address.
Host name
: Selecting the host name can ensure that your Policy Servers maintain
communication with each other even if the mapping of this host name to an IP
address is changed in DNS. However, it should be a rare event to change the IP
address of a Policy Server, since this change involves redirecting all EFW NICs to point
to the new address.
If you select the host name, it must be resolvable by the host computer for all other
Policy Servers you have or intend to add to this EFW domain. To test this, you must
be able to ping to this (unqualified) host name from all other Policy Server host
computers that you already have or intend to add to this EFW domain. For example,
if the host name is “policyserver1,” you must obtain a response from the Policy Server
host to the command “ping policyserver1” from those other systems. It is NOT
sufficient to obtain a response to a ping against the fully qualified version of this
name, as in “ping policyserver1.network.com.” If the ping test fails, you can fix it by
adding the host name to the hosts file on the other Policy Servers.