Setting Up Ha; Hardware Setup - D-Link NetDefendOS User Manual

11.3. Setting Up HA

This section provides a step-by-step guide for setting up an HA Cluster. Setup is explained in the
following subsections:
• Physical setup of the HA cluster and decisions about IP addresses is first discussed in
Section 11.3.1, "Hardware Setup".
• Configuration of NetDefendOS is then discussed and this is divided into:
i. Using the Web Interface wizard is discussed in Section 11.3.2, "Wizard HA Setup".
ii. Performing NetDefendOS setup without the wizard is discussed in Section 11.3.3,
"Manual HA Setup".
• Lastly, verifying HA operation is discussed in Section 11.3.4, "Verifying that the Cluster Functions
Correctly".

11.3.1. Hardware Setup

The steps for the setup of hardware in an HA cluster are as follows:
1. Start with two identical NetDefend Firewalls of the same model and with the same set of
available Ethernet interfaces. Both may be newly purchased or an existing hardware unit
may have a new unit added to it to create the cluster.
2. Both master and slave units must be running the same version of NetDefendOS.
3. Make the physical connections:
• Connect the matching interfaces of master and slave through separate switches or
separate broadcast domains. It is important to keep the traffic on each interface pair
separated from other pairs.
• Select one unique interface on the master and slave which is to be used by the units for
monitoring each other. This will be the sync interface. It is recommended that the same
interface is used on both master and slave, assuming they are similar systems.
Also keep in mind that there should be no NetDefendOS IP rules configured that include
the sync interface.
• Connect together the sync interfaces. This can be done directly with a suitable cable or
through a separate switch (or broadcast domain).
4. Decide on a shared IP address for each interface in the cluster. Some interfaces could have
shared addresses only while others could also have unique, individual IP addresses for each
interface specified in an IP4 HA Address object. The shared and individual addresses are used
as follows:
Caution: The sync interface must be unique
With some hardware, an interface may be part of a switch fabric which joins a
set of interfaces together.
If such an interface is used as the HA sync interface then the other interfaces
connected to the same switch fabric cannot be used for other purposes.
827
Chapter 11: High Availability