topic Re: Using Different Cluster Interfaces in Firewall and Security Management

Using Different Cluster Interfaces

biskit — Mon, 23 Nov 2020 12:27:53 GMT

In versions of old, you could specify interfaces per cluster member. This allowed me in the past to easily overcome a faulty NIC by moving one member to a different NIC and just updating the topology for that single member. I've done it a few times and it worked a treat!

Now that option appears to have gone. I have a cluster member that has developed a faulty eth0, so I want to move that cable to the spare eth6 which is proven working. When I do this the member stays "down" because the cluster is expecting to see eth0 up.

Is there a way these days to keep eth0 on one member and eth6 on the other member, like I could in the past? Otherwise I have to schedule a downtime window to change both gateways to eth6, and go on-site to install the policy from the 'inside'... It turns a 2 minute remote job (albeit with remote hands to re-patch the cable) with no downtime into a fully blown scheduled outage with a site visit, which is a royal pain in the..... and a step backwards from what we could once do.

Cheers,

Matt

Re: Using Different Cluster Interfaces

JackPrendergast — Mon, 23 Nov 2020 20:42:20 GMT

Hi Matt.

Yes.

Disable your faulty nic.

Configure your alternative interface with the correct IP details.

Edit the cluster interface on the object, go to advanced and change the relevant interface parameters shown in the screenshot! - download below

i.e member a -eth0

member b - eth6

Push policy 🙂

Re: Using Different Cluster Interfaces

biskit — Tue, 24 Nov 2020 15:31:14 GMT

Ooow, I didn't see that in the Advanced tab! Perfect thanks, I'll give that a try.

Re: Using Different Cluster Interfaces

JackPrendergast — Tue, 24 Nov 2020 16:38:12 GMT

No problem. Please 'accept as solution' to close this thread!

Thank you.