3
Addressing
70
IPv6 and High Availability
SEG
High
Availability
(HA)
does
not
fully
support
IPv6.
Any
IPv6
configuration
objects
will
be
mirrored
on
both
the
HA
master
and
slave
units.
However,
if
a
failover
occurs,
state
information
will
be
lost
when
one
unit
takes
over
processing
from
the
other
and
IPv6
connections
will
be
lost.
In
an
HA
configuration
where
interfaces
have
IPv6
enabled
and
IPv6
addresses
assigned,
there
is
no
private
and
shared
IPv6
IP
for
each
pair
of
interfaces.
Each
interface
pair
will
have
the
same
IPv6
IP
address
on
both
master
and
slave.
A
private
IPv6
interface
address
for
each
interface
in
a
pair
is
not
possible.
DNS
A
DNS
server
can
resolve
a
Fully
Qualified
Domain
Name
(FQDN)
into
the
corresponding
numeric
IP
address.
FQDNs
are
unambiguous
textual
domain
names
that
specify
a
node’s
unique
position
in
the
Internet's
DNS
tree
hierarchy.
FQDN
resolution
allows
the
actual
physical
IP
address
to
change
while
the
FQDN
stays
the
same.
A
Uniform
Resource
Locator
(URL)
differs
from
an
FQDN
in
that
the
URL
includes
the
access
protocol
along
with
the
FQDN.
For
example,
the
protocol
might
be
specified
http//:
for
world
wide
web
pages.
DNS
servers
can
exist
both
on
the
public
Internet
for
resolution
of
public
IP
addresses
as
well
as
private
servers
for
the
resolution
of
private
IP
addresses.
FQDNs
are
used
in
many
aspects
of
an
SEG
configuration
where
IP
addresses
are
unknown
or
where
it
makes
more
sense
to
use
DNS
resolution
instead
of
static
IP
addresses.
DNS with the SEG
To
accomplish
DNS
resolution,
the
SEG
has
a
built
‐
in
DNS
client
that
can
be
configured
to
use
up
to
eight
(8)
DNS
servers.
For
DNS
to
function,
at
least
a
single
server
must
be
configured.
It
is
recommended
that
at
least
two
servers
are
defined
so
that
there
is
a
backup
should
one
be
unavailable.
Features requiring DNS resolution
Having
at
least
one
DNS
server
configured
is
vital
for
the
functioning
of
the
following
modules
in
the
SEG:
•
Automatic
time
synchronization.
•
Access
to
an
external
certificate
authority
server
for
CA
signed
certificates.
DNS lookup and IP rules
In
the
case
of
a
DNS
server
request
being
generated
by
the
SEG
itself,
no
IP
rules
need
to
be
defined
for
the
connection
to
succeed.
This
is
because
connections
initiated
by
the
SEG
are
considered
to
be
trusted.
For
example,
the
SEG
might
access
a
CA
server
to
establish
the
validity
of
a
certificate
and
first
needs
to
resolve
the
certificate’s
FQDN
to
an
IP
address.
