D-Link DFL-800-AV-12 User Manual - Page 289
High Availability, 11.1. Overview
View all D-Link DFL-800-AV-12 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 289 highlights
Chapter 11. High Availability This chapter describes the high availability fault-tolerance feature in D-Link Firewalls. • Overview, page 289 • High Availability Mechanisms, page 291 • High Availability Setup , page 293 • High Availability Issues, page 296 11.1. Overview High Availability is a fault-tolerant capability that is available on certain models of D-Link Firewalls. Currently the firewalls that offer this feature are the DFL-1600 and DFL-2500 models. The pre-installed licenses for these models include HA support. HA Clusters D-Link High Availability (HA) works by adding a back-up slave D-Link Firewall to an existing master firewall. The master and slave are connected together and make up a logical HA Cluster. One of the units in a cluster will be active when the other unit is inactive and on standby. Initially the slave will be inactive and will monitor the master. If the slave detects that the master is not responding, a failover takes place and the slave becomes active. If the master later regains full functionality the slave will continue to be active, with the master now monitoring the slave and failover only taking place if the slave fails. This is sometimes known as an active-passive HA implementation. The Master and Active Units It should be kept in mind that the master unit in a cluster is not always the same as the active unit. The active unit is the D-Link Firewall that is processing all traffic at a given point in time. This could be the slave if a failover has occurred because the master's operation has been impaired. Inter-connection In a cluster, the master and slave units must be directly connected to each other by a synchronization connection which is known to NetDefendOS as the sync interface. One of the normal interfaces on the master and the slave are dedicated for this purpose and are connected together with a crossover cable. Cluster Management An HA Cluster of two D-Link Firewalls is managed as a single unit with a unique cluster name which appears in the management interface as a single logical D-Link Firewall. Administration operations such as changing rules in the IP rule set are carried out as normal with the changes automatically being made to the configurations of both the master and the slave. Load-sharing D-Link HA clusters do not provide load-sharing since only one unit will be active while the other is inactive and only two D-Link Firewalls, the master and the slave, can exist in a single cluster. The only processing function the inactive unit fulfills is to replicate the state of the active unit and to take over all traffic processing if it detects the active unit is not responding. Hardware Duplication 289