High Availability - CyberGuard SG300 User Manual

Limitations of load balancing
Load balancing works by alternating outgoing traffic across Internet connections in a
round robin manner. It does not bond both connections together to work as one link, e.g.
it does not bond two 512 kbit/s links to function as a single 1 mbit/s link.
Total bandwidth and available bandwidth are not taken into account when choosing a
connection on which to send outgoing traffic.
When an internal client makes a connection to a server on the Internet, this and
subsequent connections between the the internal client and remote server are confined
to the one Internet connection to ensure connections are not broken.
If a second internal client makes a connection to the same remote server, it may or may
not go across the same link, depending on which Internet connection is next to be
selected in the round robin process.
VPN connections such as IPSec or PPTP tunnels are confined to a single Internet
connection, as they are a single connection (that encapsulate other connections).
Load balancing is not performed for incoming traffic. This scenario can be addressed
using other solutions such as round robin DNS to alternate incoming connections
between the two links.

High Availability

Just as Internet failover keeps a redundant Internet connection on stand-by should the
primary connection fail, high availability allows a second CyberGuard SG appliance to
provide network connectivity should the primary SG appliance fail.
High availability is accomplished with two CyberGuard SG appliances on the same
network segment which provide some identical network service (such as Internet access)
to other hosts on that network segment.
A "floating" IP address (e.g. 192.168.1.1) is configured as an alias on the interface on
that network segment on exactly one of the devices. This is done via simple negotiation
between the two devices such that one device has the IP address (master) and one does
not (slave).
Note
Network Setup
69