High Availability - Secure Computing SG300 User Manual

Load balancing is not performed for incoming traffic. This scenario can be addressed
using other solutions such as round robin DNS to alternate incoming connections
between the two links.

High Availability

Just as Internet failover keeps a redundant Internet connection on stand-by should the
primary connection fail, high availability allows a second SG unit to provide network
connectivity should the primary SG appliance fail.
High availability is accomplished with two SG units on the same network segment which
provide some identical network service (such as Internet access) to other hosts on that
network segment.
A "floating" IP address (e.g. 192.168.1.1) is configured as an alias on the interface on
that network segment on exactly one of the devices. This is done via simple negotiation
between the two devices such that one device has the IP address (master) and one does
not (slave).
Note
This floating IP address is in addition to the primary IP addresses of the two devices (e.g.
192.168.1.2 and 192.168.1.3) for the interface on the network segment.
The floating IP address and primary IP addresses of the two devices need not be part of
the same network (e.g. 192.168.1.0/24), but typically will be.
As far as hosts on the network are concerned, they may use either a device's primary IP
address to address a particular device, or the floating IP address to use whichever device
is currently up.
For example, a host may have its default gateway assigned as the floating IP address.
Note
High availability does not perform stateful failover between SG units, i.e. any network
connections that were established through the failed device must be re-established
through the new master device.
68
Network Setup