Hi guys,
I was having issues with a ClusterXL set-up and wanted to know if there is a solution.
So here is what currently is correctly working (non-clusterXL):
- device: 1575 appliance, R81.10.15_996003919 (.10 build doesn't support loopback yet via GUI)
- firewallrules to allow BGP
- single WAN interface has a /31 public IP from the provider.
- loopback interface with /28 from provider that is advertised on BGP back to peer on WAN.
- a dorment (not connected) second WAN connection on different carrier with /31 public IP in same BGP set-up.
Last week we wanted to add a second firewall. This stopped working even BEFORE the member device was added.
Here is what we did:
- reset WAN interfaces to DHCP to bypass subnet restrictions on the HA wizard (seems it needs at least 3 usable IPs on all interfaces without DHCP, even if you are not going to use it. Else the wizard won't finish).
- set first device as primary cluster member with only LAN/internal interfaces in HA mode
- readded WAN interface /31 set-up (this is non-HA)
Now the problem is that "BGP peer is not reachable" (/var/log/routed). Even though only internal networks are now HA.
It seems that the non-HA interface is no longer used for advertising the BGP route. Mind you, the default gateway is still there and ANY other traffic is passed. Just not training data for the BGP.
When you Delete the cluster configuration it magically starts working again.
Second (less important for now) thing is that we have 2 /31 lines. So my thoughts were to add both to both firewalls (non-HA ofcourse) and leave one disconnected on the devices so that the firewall only uses one and the active firewall advertises on the connected one. This since the HA set-up needs at least 3 usable IP-adresses for the HA.
- second device: 1575 appliance, R81.10.15_996003919 (.10 build doesn't support loopback yet)
- loopback interface with /28 from provider that is advertised on BGP back to peer on WAN.
- firewall rules to allow SYNC traffic
- add as member to the cluster group
- WAN interface has a /31 public IP from the primary line
- DMZ interface has a /31 public IP from other line.
