18.07.2013 Views

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Chapter 17: High Availability<br />

HA configuration options<br />

490<br />

In a load sharing HA configuration, the primary is assigned the cluster address<br />

for the heartbeat burb as an alias, allowing it to communicate with the<br />

secondary. When the secondary or standby is brought online, it activates its<br />

interface IP addresses. The primary will then begin to “multicast” a heartbeat<br />

message. The heartbeat uses IPSec authentication (AH) to ensure that the<br />

messages are correct. The secondary “listens” for this heartbeat and sends an<br />

acknowledgement to the primary. If one <strong>of</strong> the <strong>Sidewinder</strong> <strong>G2</strong>s become<br />

unavailable (that is, a heartbeat message or acknowledgement is not received<br />

by a <strong>Sidewinder</strong> <strong>G2</strong> for the specified amount <strong>of</strong> time), the remaining<br />

<strong>Sidewinder</strong> <strong>G2</strong> takes over and assumes responsibility for processing all traffic.<br />

If one <strong>of</strong> the <strong>Sidewinder</strong> <strong>G2</strong>s unexpectedly becomes unavailable and the<br />

remaining <strong>Sidewinder</strong> <strong>G2</strong> takes over processing all traffic, any active proxy<br />

sessions and non-stateful IP filter sessions that were assigned to the<br />

unavailable <strong>Sidewinder</strong> <strong>G2</strong> will be lost. IP Filter sessions that are configured for<br />

stateful session failover will not be lost.<br />

If you know in advance that a <strong>Sidewinder</strong> <strong>G2</strong> will need to be shut down, you<br />

can reduce the number <strong>of</strong> lost connections by scheduling the shutdown (rather<br />

than shutting down immediately). When a shutdown is scheduled for a later<br />

time, a s<strong>of</strong>t shutdown will be performed to reduce the number <strong>of</strong> sessions that<br />

are lost. For information on s<strong>of</strong>t shutdown, see “Scheduling a s<strong>of</strong>t shutdown for<br />

an HA cluster <strong>Sidewinder</strong> <strong>G2</strong>” on page 510.<br />

Certain connections in a load sharing HA cluster will be assigned to the<br />

primary. For example, connections that are used for <strong>Sidewinder</strong> <strong>G2</strong><br />

management purposes (Admin Console, telnet, SSH) that are addressed to the<br />

shared cluster address will be assigned to the primary. In the event that the<br />

primary becomes unavailable, new connections will be assigned to the new<br />

primary, and existing connections will remain in tact. SNMP connections that<br />

are addressed to the shared address will also be assigned to the primary.<br />

Connections that are specifically addressed to an individual <strong>Sidewinder</strong> <strong>G2</strong><br />

address, will be assigned to the specified <strong>Sidewinder</strong> <strong>G2</strong>.<br />

Failover HA<br />

Failover HA consists <strong>of</strong> one <strong>Sidewinder</strong> <strong>G2</strong> (the primary) actively processing<br />

traffic with the standby acting as a hot backup. When a standby <strong>Sidewinder</strong> <strong>G2</strong><br />

is registered to an HA cluster, synchronized areas will be overwritten by the HA<br />

cluster configuration. (To determine which areas are synchronized, see<br />

“Managing an HA cluster” on page 503.) Once registered, the standby monitors<br />

the primary through an Ethernet-based “heartbeat” mechanism that functions<br />

between <strong>Sidewinder</strong> <strong>G2</strong>s. If the standby determines that the primary is<br />

unavailable, the standby takes over and assumes the role <strong>of</strong> the primary. When<br />

a standby takes over networking functions, any active proxy sessions through<br />

the primary are lost. IP Filter sessions that are configured for stateful session<br />

failover will not be lost.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!