High Availability - Secure Computing SG300 User Manual

VPN connections such as IPSec or PPTP tunnels are confined to a single Internet
connection, as they are a single connection (that encapsulate other connections).
Load balancing is not performed for incoming traffic. This scenario can be addressed
using other solutions such as round robin DNS to alternate incoming connections
between the two links.

High Availability

Just as Internet failover keeps a redundant Internet connection on stand-by should the
primary connection fail, high availability allows a second SnapGear unit to provide
network connectivity should the primary SnapGear unit fail.
High availability is accomplished with two SnapGear units on the same network segment
which provide some identical network service (such as Internet access) to other hosts on
that network segment.
A "floating" IP address (e.g. 192.168.1.254) is automatically configured as an alias on the
interface on that network segment on exactly one of the SnapGear units. This is done via
simple negotiation between the two SnapGear units such that one unit has the IP
address (master) and one does not (slave).
Note
This floating IP address is in addition to the primary IP addresses of the two SnapGear
units (e.g. 192.168.1.1 and 192.168.1.2) for the interface on the network segment.
The floating IP address and primary IP addresses of the two SnapGear units need not be
part of the same network (e.g. 192.168.1.0/24), but typically will be.
Typically, hosts on the local network will use the floating IP address as their gateway, and
only use the devices' primary IP addresses when they need to contact a particular
SnapGear unit, e.g. to access that unit's management console.
The following diagrams illustrate the basic HA configuration discussed above.
70
Network Setup