11.4. HA Issues
The following points should be kept in mind when managing and configuring an HA Cluster.
SNMP
SNMP statistics are not shared between master and slave. SNMP managers have no failover
capabilities. Therefore both firewalls in a cluster need to be polled separately.
Using Individual IP Addresses
The unique individual IP addresses of the master and slave cannot safely be used for anything but
management. Using them for anything else, such as for source IPs in dynamically NATed
connections or publishing services on them, will inevitably cause problems since unique IPs will
disappear when the firewall they belong to does.
Failed Interfaces
Failed interfaces will not be detected unless they fail to the point where NetDefendOS cannot
continue to function. This means that failover will not occur if the active unit can still send "I am
alive" heartbeats to the inactive unit through any of its interfaces, even though one or more
interfaces may be inoperative.
Changing the Cluster ID
Changing the cluster ID in a live environment is not recommended for two reasons. Firstly this will
change the hardware address of the shared IPs and will cause problems for all units attached to the
local LAN, as they will keep the old hardware address in their ARP caches until it times out. Such
units would have to have their ARP caches flushed.
Secondly this breaks the connection between the firewalls in the cluster for as long as they are using
different configurations. This will cause both firewalls to go active at the same time.
Invalid Checksums in Heartbeat Packets
Cluster Heartbeats packets are deliberately created with invalid checksums. This is done so that they
will not be routed. Some routers may flag this invalid checksum in their log messages.
Making OSPF work
If OSPF is being used to determine routing metrics then a cluster cannot be used as the designated
router.
If OSPF is to work then there must be another designated router available in the same OSPF area as
the cluster. Ideally, there will also be a second, backup designated router to provide OSPF metrics if
the main designated router should fail.
11.4. HA Issues
Chapter 11. High Availability
417
Содержание 800 - DFL 800 - Security Appliance
Страница 24: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 24 ...
Страница 69: ...2 6 4 Restore to Factory Defaults Chapter 2 Management and Maintenance 69 ...
Страница 121: ...3 9 DNS Chapter 3 Fundamentals 121 ...
Страница 166: ...interfaces without an overriding IGMP Setting Default 1 000 4 6 4 Advanced IGMP Settings Chapter 4 Routing 166 ...
Страница 181: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 181 ...
Страница 192: ...5 5 IP Pools Chapter 5 DHCP Services 192 ...
Страница 282: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 282 ...
Страница 300: ...mechanism 7 3 7 SAT and FwdFast Rules Chapter 7 Address Translation 300 ...
Страница 301: ...7 3 7 SAT and FwdFast Rules Chapter 7 Address Translation 301 ...
Страница 303: ... Changed on a regular basis such as every three months 8 1 Overview Chapter 8 User Authentication 303 ...
Страница 318: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 318 ...
Страница 322: ...ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 322 ...
Страница 377: ...Management Interface Failure with VPN Chapter 9 VPN 377 ...
Страница 408: ...10 4 6 SLB_SAT Rules Chapter 10 Traffic Management 408 ...
Страница 419: ...11 5 HA Advanced Settings Chapter 11 High Availability 419 ...
Страница 426: ...12 3 5 Limitations Chapter 12 ZoneDefense 426 ...
Страница 449: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 449 ...