High Availability; Overview - D-Link NetDefend DFL-210 User Manual

Chapter 11. High Availability
This chapter describes the high availability fault-tolerance feature in D-Link Firewalls.
• Overview, page 409
• HA Mechanisms, page 411
• HA Setup, page 413
• HA Issues, page 417
• HA Advanced Settings, page 418

11.1. Overview

High Availability is a fault-tolerant capability that is available on certain models of D-Link
Firewalls. Currently the firewalls that offer this feature are the DFL-1600 and DFL-2500 models.
The pre-installed licenses for these models include HA support.
HA Clusters
D-Link High Availability (HA) works by adding a back-up slave D-Link Firewall to an existing
master firewall. The master and slave are connected together and make up a logical HA Cluster. One
of the units in a cluster will be active when the other unit is inactive and on standby. Initially the
slave will be inactive and will monitor the master. If the slave detects that the master is not
responding, a failover takes place and the slave becomes active. If the master later regains full
functionality the slave will continue to be active, with the master now monitoring the slave and
failover only taking place if the slave fails. This is sometimes known as an active-passive HA
implementation.
The Master and Active Units
When reading this section on HA, it should be kept in mind that the master unit in a cluster is not
always the same as the active unit in a cluster.
The active unit is the D-Link Firewall that is actually processing all traffic at a given point in time.
This could be the slave unit if a failover has occurred because the master is no longer operational.
Interconnection
In a cluster, the master and slave units must be directly connected to each other by a synchronization
connection which is known to NetDefendOS as the sync interface. One of the normal interfaces on
the master and the slave are dedicated for this purpose and are connected together with a crossover
cable.
Packets, known as heartbeats, are continually sent across the sync and all other interfaces from one
unit to the other so that peer health can be monitored and this mechanism is discussed further in the
section that follows. These packets are sent in both directions so that the passive unit knows about
the health of the active unit and the active knows about the passive.
Cluster Management
An HA Cluster of two D-Link Firewalls is managed as a single unit with a unique cluster name
which appears in the management interface as a single logical D-Link Firewall. Administration
409