How to Configure High Availability Stand-Alone CloudGen Firewalls for Virtual Routing
When configuring a virtual router instance for an HA pair, the configuration is transparently transferred to the secondary firewall after being completed on the primary firewall. There is no need to make any configuration for the secondary firewall.
Before You Begin
Verify that two firewalls are operating in high availability mode. For more information, see How to Set Up a High Availability Cluster.
Configuration
In the following example, an additional virtual instance will be created that routes traffic between a private network (e.g., 192.168.0.0/24) and the Internet. In this setup, the firewall service will be transparent to the additional virtual router instance only if authenticated users are not defined. All other services are not available to the additional virtual router. For more information on which services are available for additional virtual instances, see Virtual Routing and Forwarding (VRF).
Step 1. Create a Virtual Router Instance on the Primary Firewall
When creating a router instance on the primary firewall, the configuration will be mirrored to the secondary firewall.
Log into the primary firewall.
Right-click CONFIGURATION > Configuration Tree > Box > Network.
Select Lock.
Right-click CONFIGURATION > Configuration Tree > Box > Network.
Select Create VR Instance from the list.
The Create a new VR Instance window is displayed.
The window for naming the virtual router is displayed.
Enter the name for the virtual router, e.g.,
VR01.Click OK.
Click Send Changes.
The Activate Changes window opens.
Click Activate.
VR Node on Primary Stand-alone Firewall | VR Node on Secondary Stand-alone Firewall (Configured via Primary) |
|---|---|
| |
Step 2. Assign Interfaces to the VR Instance
The configuration for the interfaces will be forwarded from the primary to the secondary HA partner.
On your primary firewall, double-click CONFIGURATION > Configuration Tree > Box > Network.
In the left menu bar, click Virtual Router.
Click Lock.
In the Interface Assignment list, double-click the first interface to assign the VR Instance, e.g., eth2.
The Interface Assignment window is displayed.
For VR Instance, select VR01.
Click OK.
In the Interface Assignment list, double-click the second interface to assign the VR Instance, e.g., eth3.
The Interface Assignment window is displayed.
For VR Instance, select VR01.
Click OK.
Click Send Changes.
Click Activate.
Step 3. Re-activate the New Network Configuration
On your secondary HA firewall, go to CONTROL > Box.
In the left menu, click Network to expand the menu.
Click Activate new network configuration.
The Network Activation window is displayed.
Click Failsafe.
Step 4. Assign IP Addresses to the Interfaces of the VR Instance
Go to CONFIGURATION > Configuration Tree > Box > Network > VR Instance [ your virtual instance ].
In the left menu bar, select IP Configuration.
Click Lock.
Click + to assign the first IP address to the first interface, e.g., eth2 =
192.168.0.254.The IPv4 Addresses window is displayed.
Enter the name for the first IP address to interface assignment, e.g.,
VRF-to-CLASSROOM1.Enter the IPv4 Address Configuration
Interface Name – eth2
IP Address – Enter the private network address, e.g.,
192.168.0.254.Responds to Ping – yes.
Click OK.
Click + to assign the second IP address to the first interface, e.g., eth3 = 62.99.0.33.
The IPv4 Addresses window is displayed.
Enter the name for the second IP address to interface assignment, e.g.,
VRF-to-INTERNET.Enter the IPv4 Address Configuration
Interface Name – eth3
IP Address – Enter the private network address, e.g.
62.99.0.33.Responds to Ping – yes.
Default Gateway – Enter the IP address for the Internet gateway, e.g.,
62.99.0.254.
Click OK.
Click Send Changes.
The Activate Changes window opens.
Click Activate.