topic Re: office mode network/clusterXL HA/SSLVPN/network extender in SASE and Remote Access

office mode network/clusterXL HA/SSLVPN/network extender

Daniel_Kavan — Thu, 28 Feb 2019 14:56:14 GMT

With ClusterXL HA (active/standby) RE: office mode network for SSLVPN (network extender mode) - Is it recommended to define one OM network for each member in the cluster (a seperate network for each member)? Or is it recommended/required to have one office mode network defined (the same one) and configured one each member? My guess is with HA, they'll be using one gw or the other so it's preferred to define the same network.

Re: office mode network/clusterXL HA/SSLVPN/network extender

Jerry — Thu, 28 Feb 2019 16:47:14 GMT

Only one OfficeMode (MAB?) subnet for the whole SSLVPN NetX VPN Users - no need to create multiply OM subnets really. I don't get your point how HA is relevant to this ... have you ever used HA in Active/Passive mode before?

You know what VMAC stands for? or VIP on each "clusterred" interface? You don't need to worry about multiply OM subnets. Just make one, add to the config. and off you go

Re: office mode network/clusterXL HA/SSLVPN/network extender

Daniel_Kavan — Wed, 22 May 2019 18:01:56 GMT

Office Mode addresses can be allocated from an IP pool or by a DHCP server. If addresses are allocated from an IP pool, a separate IP pool must be defined for every cluster member. This prevents the allocation of the same IP address to different clients simultaneously.

I assume I route these to my INT-VIP IP, not the respective gws.

Re: office mode network/clusterXL HA/SSLVPN/network extender

Daniel_Kavan — Wed, 05 Jun 2019 13:42:46 GMT

Per case 6-0001647364

We are both right. For Active/Active two sepeate ip pools are recommended. For active/standby the same pool can be used on both nodes.

Each node what has been assigned, they are in sync.

Re: office mode network/clusterXL HA/SSLVPN/network extender

Vladimir — Thu, 23 May 2019 16:54:22 GMT

If you are assigning Office Mode IPs from the Pool, it makes sense to split it in two and serve half from each cluster member in HA configuration.

The reason for this is that if one of the unit has leased the IP to the client and then the failover has occurred, no duplicate IPs will be leased.