Configuring ClusterXL on Threat Emulation Appliance(TE250XN)

[tytdoge]

Hi,

I was trying to setup a HA architecture and wish to use the cluster VIP to be the API endpoint for 2 TE250XN Appliance to receive malicious files.

However, after i have setup cluster on the Security Management Server and also enabled the cluster membership on both TE Appliance, here's what i got when checking the HA status

[Expert@hostname:0]# cphaprob stat

HA module not started.

and here is the debug output from cphaconf.elg
---Starting debug---

[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] cphaconf called with these arguments: cphaconf stop
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] DEBUG: fwd_reload_database_file: Start
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] in fwd_reload_database(do_database=1, dir=database, fn=objects.C
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwa_db_init: calling fwme_init_module
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwa_db_init: called
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] do_links_getver: strncmp failed. Returning -2
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwobj_destroy_reference_hash: reference_resolving_hash_users<0
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] reference_resolving_hash created
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwd_load_nat_fix_registry_params: failed get NAT_NEGATE_FIX key from registry, set default
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwd_load_nat_fix_registry_params: failed get NAT_MAIN_IP_FIX key from registry, set default
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] CachedObject::SetObject: small size, modifying (0 --> 10)
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] CachedObject::CreateHash: Created internal hashtable, size: 10
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] fwha_mcset_terminate: failed to open the /opt/CPsuite-R81/fw1/tmp/fwhamcd.pid file
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] stop_ha: fwha_mcset_terminate failed
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] cpuser_socket_connect: Connecting to server /vs0/dev/fw0 for /dev/fw0
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] cpuser_socket_connect: connected socket 12
[cphaconf 18627 4123109184]@HKTLSGTE02[11 Aug 15:30:32] stop_ha: HA stopped successfully
[cphaconf 11860 4122294080]@HKTLSGTE02[11 Aug 16:02:43]

Do anyone have same experience on it? or there are just impossible to start HA cluster for TE250XN (R81)?

[emmap · Accepted solution]

The TE appliances aren't designed to work in a cluster, they should be deployed as independent devices and have the load balancing / high availability be achieved by the devices sending the files.

[tytdoge]

Hi emmap,

Thank you for your reply, but i can see there is a Sync interface on TE250XN model. What is the usage for that port if it is not designed to work in a cluster?

[emmap · Accepted solution]

The hardware spec is not specific to TE appliances, the Sync port is there for other applications.

[tytdoge]

OK Thank you for your explanation!

[Chris_Atkinson]

If it helps with understanding sk110369, sk102309 outline ways that multiple TE appliances are leveraged otherwise.

So as @emmap suggests for your application you need to implement the load-balancing in front of the TE appliances. 

[Lari_Luoma]

Hi!

As far as I know TE appliances cannot be clustered the same way as regular gateways. To achieve HA multiple gateways can be configured to use different TE appliances for threat emulation.

[Forsaken_61]

Hi 

As previous users have replied. You cannot cluster Threat Emulation Appliances for load balacing.
Bumped almost into the same issue.

To fix this I've a Security Gateway in front, which Is configured to send files for Remote Emulation to my Threat Emulation Appliance boxes.