topic Cluster Failover in Firewall and Security Management

Cluster Failover

Heisenberg — Sun, 09 Aug 2020 15:30:45 GMT

Hi,

We will be having a cluster deployment (mode not decided yet) but the setup is that going to internal we will be connected on a L2 switch on stacked deployment but the catch here is that there are no mesh connections, only Cluster Member 1 going to SW1 and Cluster Member 2 going to SW2.

We suggest doing a mesh connectivity but we are already out of SFP Ports to use. Given the scenario:

1. If the SW1/SW2 appliance fails meaning no traffic is being fed to Cluster Member 1 or 2 does cluster failover occurs?

2. If only a single interface on either SW1/SW2 going to the Cluster Member's fails meaning no traffic is being fed to Cluster Member 1 or 2 on that specific peer interface from SW1/SW2, does cluster failover occurs?

3. Since the SW1 and SW2 are configured as stacked with no mesh connectivity going on to the Cluster Members, what is the best approach in terms of what Cluster Deployment (High Availability or Load Sharing) is advisable? Pros and Cons of either deployment to the given scenario.

Thanks

Re: Cluster Failover

HeikoAnkenbrand — Sun, 09 Aug 2020 18:02:25 GMT

Use a HA bond (LACP) interface for fully meshed redundancy.

The bonding High Availability mode, when deployed with ClusterXL, enables a higher level of reliability by providing granular redundancy in the network. This granular redundancy is achieved by using a fully meshed topology, which provides for independent backups for both NICs and switches.

A fully meshed topology further enhances the redundancy in the system by providing a backup to both the interface and the switch, essentially backing up the cable. Each cluster member has two external interfaces, one connected to each switch.

More here: Bond HA in Cluster Fully Meshed Redundancy

Re: Cluster Failover

Heisenberg — Mon, 10 Aug 2020 16:01:46 GMT

Hi HeikoAnkenbrand,

Can you explain what possible scenarios/downside that will happen to the network flow if given that the setup will not be using fully meshed topology.