How to Configure High Availability CC-Managed CloudGen Firewalls for Virtual Routing

When configuring a virtual router instance for a CC-managed HA pair, the configuration is transparently transferred to the secondary firewall after being completed for the primary firewall. There is no need to make any configuration for the secondary firewall.

Before You Begin

Verify that two firewalls are operating in high availability mode. For more information, How to Set Up a Managed High Availability Cluster from Scratch.

Configuration

In the following example, an additional virtual instance will be created that routes traffic between a private network (e.g., 192.168.0.0/24) and the Internet. In this setup, the firewall service will be transparent to the additional virtual router instance only if authenticated users are not defined. All other services are not available to the additional virtual router. For more information on which services are available for additional virtual instances, see Virtual Routing and Forwarding (VRF).

Step 1. On the CC, Create a Virtual Router Instance for the Primary Firewall

When creating a router instance for the primary firewall, the configuration will be mirrored to the secondary firewall.

Log into the Control Center.
Right-click CONFIGURATION > Configuration Tree > Multi Range > your range > your cluster > Boxes > your primary firewall > Network.
Select Lock.
Right-click CONFIGURATION > Configuration Tree > Multi Range > your range > your cluster > Boxes > your primary firewall > Network.
Select Create VR Instance from the list.
The Create a new VR Instance window is displayed.
The window for naming the virtual router is displayed.
Enter the name for the virtual router, e.g., VR01.
Click OK.
Click Send Changes.
The Activate Changes window opens.
Click Activate.

VR Node configured in Control Center	VR Node on Managed Primary Firewall	VR Node on Managed Secondary Firewall

Step 2. Assign Interfaces to the VR Instance

The configuration for the interfaces will be forwarded from the primary to the secondary HA partner.

On your Control Center, double-click CONFIGURATION > Configuration Tree > Multi Range > your range > your cluster > Boxes > your primary firewall > Network.
In the left menu bar, click Virtual Router.
Click Lock.
In the Interface Assignment list, double-click the first interface to assign the VR Instance, e.g., eth2.
The Interface Assignment window is displayed.
For VR Instance, select VR01.
Click OK.
In the Interface Assignment list, double-click the second interface to assign the VR Instance, e.g., eth3.
The Interface Assignment window is displayed.
For VR Instance, select VR01.
Click OK.
Click Send Changes.
Click Activate.

Step 4. Assign IP Addresses to the Interfaces of the VR Instance

On your Control Center, go to CONFIGURATION > Configuration Tree > Multi-Range > your range > your cluster > Boxes > your primary firewall > Network > VR Instance [ your virtual instance ].
In the left menu bar, select IP Configuration.
Click Lock.
Click + to assign the first IP address to the first interface, e.g., eth2 = 192.168.0.254.
The IPv4 Addresses window is displayed.
Enter the name for the first IP address to interface assignment, e.g., VRF-to-CLASSROOM1.
Enter the IPv4 Address Configuration
1. Interface Name – eth2
2. IP Address – Enter the private network address, e.g., 192.168.0.254.
3. Responds to Ping – yes.
Click OK.
Click + to assign the second IP address to the first interface, e.g., eth3 = 62.99.0.33.
The IPv4 Addresses window is displayed.
Enter the name for the second IP address to interface assignment, e.g., VRF-to-INTERNET.
Enter the IPv4 Address Configuration
1. Interface Name – eth3
2. IP Address – Enter the private network address, e.g. 62.99.0.33.
3. Responds to Ping – yes.
4. Default Gateway – Enter the IP address for the Internet gateway, e.g., 62.99.0.254.
Click OK.
Click Send Changes.
The Activate Changes window opens.
Click Activate.