topic Re: best practice on Full HA setup in Firewall and Security Management

best practice on Full HA setup

LeeBingKang — Mon, 21 Feb 2022 09:29:15 GMT

Hello Guys,

Recently, i have a question flowed out from my mind on what is the best practice setup of FULL HA:

1. active management and firewall on one of the member

2. active management one of the member and the active firewall will be on another member

Kindly advise and appreciate for your effort.

Thank you.

Re: best practice on Full HA setup

G_W_Albrecht — Mon, 21 Feb 2022 09:36:55 GMT

Out of my experience, i can not recommend Full Management HA Cluster deployment at all. But yes, you would have the active FW on one and primary management on the other node.

Re: best practice on Full HA setup

_Val_ — Mon, 21 Feb 2022 11:15:37 GMT

I second what @G_W_Albrecht says 👆🏻, Full HA cannot be considered a best practice in the first place because of certain limitations and complexity.

Now, whether you want to run bot FW and MGMT on the same machine or not, it depends on where you SmartConsole client is located. It may or may not be a good idea to run MGMT on the secondary. From a performance perspective, it does make sense to keep MGMT active on your standby FW node.

Re: best practice on Full HA setup

Chris_Atkinson — Mon, 21 Feb 2022 11:20:35 GMT

Agree with the others, aim to move to a distributed setup if you can then employ HA of the respective components.

Re: best practice on Full HA setup

LeeBingKang — Tue, 22 Feb 2022 03:49:53 GMT

Noted with thanks