Ha Issues - D-Link NetDefendOS User Manual

11.4. HA Issues

The following points should be kept in mind when configuring and managing an HA Cluster.
ALGs are Not State Synchronized
No aspect of ALGs are state synchronized in a NetDefendOS high availability cluster. This means
that all traffic handled by ALGs will freeze when a cluster fails over to the other peer. However, if
the cluster fails back over to the original peer within approximately half a minute, frozen sessions
and their associated transfers should begin working again.
Transparent Mode
There is no loop avoidance with HA so this should not be configured with HA. Switch routes and
therefore transparent mode do not have state synchronization.
VPN Tunnel Synchronization
NetDefendOS provides complete synchronization for IPsec tunnels in an HA cluster. In the event
of a failover occurring, incoming clients should not need to re-establish their tunnels.
However, NetDefendOS does not provide HA support for the following:
• PPTP
• L2TP
• L2TPv3
• SSL VPN
In the event of a failover occurring for these types of tunnel, incoming clients must re-establish
their tunnels after the original tunnels are deemed non-functional. The timeout for this varies
depending on the client and is typically within the range of a few seconds to a few minutes.
DHCP
Servers for IPv4 DHCP as well as DHCPv6 have full HA synchronization support. However, the
clients for both IPv4 DHCP and DHCPv6 are not supported. If either type of client is configured on
an interface, this will result in the error message Shared HA IP address not set when trying to
commit the configuration.
Real-time Monitoring
The Real-time Monitor will not automatically track the active NetDefend Firewall. If a Real-time
Monitor graph shows nothing but the connection count moving, then the cluster has probably
failed over to the other unit.
All Cluster Interfaces Need IP Addresses
All interfaces on both HA cluster units should have a valid private IP4 address object assigned to
them. The predefined IP object local host could be assigned for this purpose. The need to assign
an address is true even if an interface has been disabled.
SNMP
834
Chapter 11: High Availability