Appendix B: HA for V6x00 and Virtual Appliances
Configuring HA for V6x00 and Virtual Appliances
DSM Installation and Configuration Guide
Copyright 2009 - 2020 Thales Group. All rights reserved.
136
Prerequisites
Refer to
"Configuration tasks" on page 27
, for how to configure a DSM V6100 or virtual appliance.
Before you set up your HA cluster, do the following:
1. Specify a hostname resolution method, see
"Specify host name resolution method" on page 26
You can map a host name to an IP address using a Domain Name Server (DNS). DNS is the preferred method of
host name resolution.
You can modify the
hosts
file on the HA node:
a. Log in to the CLI menu.
b. Type:
network
c. Type:
host add <hostname> <IP address>
You can also identify a host using only the IP address.
o
If you use DNS to resolve host names, use the FQDN for the host names.
n
Both forward and reverse address resolution is required for nodes in a cluster.
n
FQDN name can be lower or uppercase, however, the DSM converts and displays all node names as
lowercase.
2. Open all required ports. To see the ports to configure, see
"Ports to Configure" on page 171
Note
For upgrades and fresh installations of DSM 6.2.0, if you are using HA, you must open port 5432 in your
firewall to allow communication between DSM HA nodes. For Azure and AWS platforms, you will need to
add this port to your security groups. You can now close port 50000 as it is no longer used.
3. Perform a ‘ping’ operation on all of the DSMs to ensure that network communication is working between the DSM
HA nodes.
Network Latency
If the network latency between the HA nodes exceeds 100ms, you may experience delays in HA replication,
especially if you have many policies, or you have large policies that contain many resource sets, user sets, etc.
Another factor in network latency is the Policy Version History setting (System > General Preferences > System >
Policy (Maximum Number of Saved Policy History). Each time changes are made to a policy, a new version of that
policy is created. This setting determines how many previous versions of the policy to keep. The more versions that
are kept, the longer the delay because it increases the time required to replicate policy data to the cluster nodes. We
recommend changing this value to 0 or 5 from the default of 10 if you experience network latency.
Configuring the Hardware
To configure HA for the V6100 hardware appliance, you need the following:
l
Two V6100 appliances installed and configured.
l
A trusted verification device (TVD) connected to a laptop or PC that is connected to the V6100 appliance.
l
A quorum of activated smart cards to perform administrative actions and their pass phrases. See
for more about the ACS.
