The Synchronization Interface - D-Link NetDefend DFL-210 User Manual

11.2.3. The synchronization interface

When three heartbeats are missed, i.e. after 0.6 seconds, the peer will be deemed inoperative.
So, why not make it even faster? Maybe send a hundred heartbeats per second and declare a firewall
inoperative after missing only two of them? This would after all result in a 0.02-second failover
time.
The problem with detection times less than one tenth of a second is that such delays may occur dur-
ing normal operation. Just opening a file, on either firewall, could result in delays long enough to
cause the inactive system to go active, even though the other is still active; a clearly undesirable
situation.
Cluster heartbeats have the following characteristics:
• The source IP is the interface address of the sending firewall
• The destination IP is the shared IP address
• The IP TTL is always 255. If NetDefendOS receives a cluster heartbeat with any other TTL, it is
assumed that the packet has traversed a router, and hence cannot be trusted at all.
• It is an UDP packet, sent from port 999, to port 999.
• The destination MAC address is the ethernet multicast address corresponding to the shared hard-
ware address, i.e. 11-00-00-C1-4A-nn. Link-level multicasts were chosen over normal unicast
packets for security reasons: using unicast packets would have meant that a local attacker could
fool switches to route the heartbeats somewhere else, causing the peer system to never hear the
heartbeats.
11.2.3. The synchronization interface
Both firewalls are connected to each other by a separate synchronization connection; normal net-
work cards are used, although they are dedicated solely to this purpose.
The active system continuously sends state update messages to its peer, informing it of connections
that are opened, connections that are closed, state and life time changes in connections, etc.
When the active system ceases to function, for whatever reason and for even a short time, the cluster
heartbeat mechanism described above will cause the inactive system to go active. Since it already
knows about all open connections, communication can continue to flow uninterrupted.
232
Chapter 11. High Availability