Chapter 13: Pooling/Redundancy/Vip/Grouping - Tavve zoneranger User Manual

Chapter 13: Pooling/Redundancy/VIP/Grouping

ZoneRanger deployments typically place two or more ZoneRangers in each firewall-partitioned
network, for one or both of the following reasons:
•
High availability (i.e. if one ZoneRanger fails, the other ZoneRanger(s) can handle the required
management protocol proxy traffic).
•
High capacity (i.e. by deploying multiple ZoneRangers in a load balancing configuration, the
total volume of management protocol traffic that can be proxied to/from the firewall-partitioned
network is increased).
High availability and high capacity are supported by a variety of Ranger Gateway and ZoneRanger
mechanisms as described in the following sections.
Pooling
The simplest configuration for multiple ZoneRangers in the same network partition is referred to as
pooling. A pool of ZoneRangers is essentially a set of multiple ZoneRangers, each unaware of the
others, that are deployed in the same network partition and are joined to the same Ranger Gateway(s).
Each Ranger Gateway that uses the pool is configured with an understanding that each of the
ZoneRangers in the pool is equally capable of relaying management protocol traffic to a given set of
devices (i.e. the devices in the network partition where the ZoneRanger pool is deployed). The Ranger
Gateway can be configured to distribute management protocol proxy transactions across the pool in a
load-balancing fashion, in order to achieve high capacity. In addition, if the Ranger Gateway detects that
it is unable to communicate with one of the members of the pool, traffic will be distributed to the
remaining members, in order to achieve high availability.
Pooling is implemented within the Ranger Gateway's Proxy Map service, and affects management
protocol traffic originated by the management application, such as ICMP proxy or SNMP Get/Set proxy.
The following figure illustrates a simple pool of four ZoneRangers. Note that the Proxy Map
configuration indicates that each of the ZoneRangers is equally capable of relaying management
protocol traffic to any of the managed devices in the DMZ where they have been deployed.
Figure 13-1. ZoneRanger Pooling Example
ZoneRanger 5.5 User's Guide 37