User manual SONICWALL SONICOS 5.6.5 ACTIVE-ACTIVE CLUSTERING

[. . . ] Active/Active Clustering in SonicOS 5. 6. 5 Document Scope This document provides conceptual information and describes how to configure and use the Active/Active Clustering feature in SonicOS 5. 6. 5. This document contains the following sections: · · · · · · · "Feature Overview" section on page 1 "Prerequisites" section on page 16 "Configuration Task List" section on page 19 "Physically Connecting Your Appliances" section on page 20 "Configuring Active/Active Clustering and High Availability" section on page 23 "Verifying Active/Active Clustering Configuration" section on page 37 "Related Features" section on page 41 Feature Overview This section provides an introduction to the Active/Active Clustering feature. This section contains the following subsections: · · · · "What is Active/Active Clustering?" section on page 1 "Benefits of Active/Active Clustering" section on page 3 "How Does Active/Active Clustering Work?" section on page 4 "Platform and Feature Support Information" section on page 13 What is Active/Active Clustering? This section provides a brief overview of the following topics: · · "Background: High Availability in SonicOS" on page 2 "Active/Active Clustering in SonicOS 5. 6. 5. 0" on page 3 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 1 Feature Overview Background: High Availability in SonicOS Stateless High Availability The first SonicWALL High Availability solution allowed two identical SonicWALL security appliances running the same version of SonicOS Enhanced to be configured as a High Availability Pair (HA pair) to provide a reliable, continuous connection to the public Internet. In the event of the failure of the Primary SonicWALL in an HA pair, the Backup SonicWALL takes over to secure a reliable connection between the protected network and the Internet. [. . . ] After the appliances are associated as an HA pair, they can share licenses. In addition to High Availability licenses, this includes the SonicOS Enhanced license, the Support subscription, and the security services licenses. The only licenses that are not shareable are for consulting services, such as the SonicWALL GMS Preventive Maintenance Service. It is not required that the Primary and Backup appliances have the same security services enabled. The security services settings will be automatically updated as part of the initial synchronization of settings. License synchronization is used so that the Backup appliance can maintain the same level of network protection provided before the failover. MySonicWALL provides several methods of associating the two appliances. You can start by registering a new appliance, and then choosing an already-registered unit to associate it with. You can also start the process by selecting a registered unit and adding a new appliance with which to associate it. For detailed procedures describing the association process on MySonicWALL, see the High Availability chapter in the SonicOS 5. 6 Administrator's Guide, available on: http://www. sonicwall. com/us/Support. html 16 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide Prerequisites Note Even if you first register your appliances on MySonicWALL, you must individually register both the Primary and the Backup appliances from the SonicOS management interface while logged into the individual management IP address of each appliance. This allows the Backup unit to synchronize with the SonicWALL license server and share licenses with the associated Primary appliance. When Internet access is restricted, you can manually apply the shared licenses to both appliances. For information about configuring and using the individual management IP address of each appliance, see "About High Availability Monitoring" on page 11 and "Configuring High Availability Monitoring" on page 31. Licensing High Availability Features Active/Active Clustering, Stateful High Availability, and Active/Active DPI licenses are included on registered SonicWALL NSA E-Class appliances. Because Active/Active Clustering is supported only on E-Class appliances, you do not need to purchase any additional licenses to use these High Availability features in SonicOS 5. 6. 5. Note Active/Active Clustering and Stateful High Availability licenses must be activated on each appliance, either by registering the unit on MySonicWALL from the SonicOS management interface, or by applying the license keyset to each unit if Internet access is not available. You can view system licenses on the System > Licenses page of the management interface. When the SonicWALL security appliances in the Active/Active cluster have Internet access, each appliance in the cluster must be individually registered from the SonicOS management interface while the administrator is logged into the individual management IP address of each appliance. This allows the Backup units to synchronize with the SonicWALL licensing server and share licenses with the associated Primary appliances in each HA pair. There is also a way to synchronize licenses for an HA pair whose appliances do not have Internet access. When live communication with SonicWALL's licensing server is not permitted due to network policy, you can use license keysets to manually apply security services licenses to your appliances. When you register a SonicWALL security appliance on MySonicWALL, a license keyset is generated for the appliance. However, until you apply the licenses to the appliance, it cannot perform the licensed services. Note In a High Availability deployment without Internet connectivity, you must apply the license keyset to both of the appliances in the HA pair. You can use one of the following procedures to apply licenses to an appliance: · · "Activating Licenses from the SonicOS User Interface" on page 18 "Copying the License Keyset from MySonicWALL" on page 18 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 17 Prerequisites Activating Licenses from the SonicOS User Interface Follow the procedure in this section to activate licenses from within the SonicOS user interface. [. . . ] Figure 13 shows the NAT policy automatically created for Virtual Group 2 on interface X1. Figure 13 Default NAT Policy SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 35 Configuring Active/Active Clustering and High Availability Figure 14 shows the selections for the Virtual Group option in the Add NAT Policy window when creating a custom NAT policy. Figure 14 Custom NAT Policy 36 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide Verifying Active/Active Clustering Configuration Verifying Active/Active Clustering Configuration This section describes several methods of verifying the correct configuration of Active/Active Clustering and Active/Active DPI. See the following: · · · · · "Comparing CPU Activity on Appliances in a Cluster" on page 37 "Verifying Settings in the High Availability > Status Page" on page 38 "Additional Parameters in TSR" on page 39 "Responses to DPI Matches" on page 40 "Logging" on page 40 Comparing CPU Activity on Appliances in a Cluster On the active firewall of the Master node, the System > Diagnostics page with Multi-Core Monitor selected shows the activity of all appliances in the Active/Active cluster. Figure 15 displays the Multi-Core Monitor on an Active/Active cluster with Active/Active DPI enabled. This configuration utilizes all units in the cluster for the highest possible performance. Figure 15 System > Diagnostics Page for Multi-Core Monitor When Active/Active DPI is enabled on a Stateful HA pair, you can observe a change in CPU utilization on appliances in the HA pair. [. . . ]