Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
Redundant Firewalls
119
213455-L, October 2005
(see
Setting up the basic configuration on page 37
). The general order for configuring
redundant Switched Firewalls is presented in
Installing the redundant Switched Firewall on
page 128
.
Clustered firewalls act as virtual routers in a redundant relationship using VRRP. In a active-
standby (high-availability) configuration, only one firewall passes traffic, while the redundant
firewall is a dedicated backup. In an active-active configuration, both firewalls process
separate traffic streams, but each is available to backup the other when a failure occurs unless
the Preferred Master parameter is configured. For more information about the Preferred Master
command, see
Preferred Master on page 124
.
The firewall with the higher IP address is the default master. The firewall with the lower IP
address is the default backup. Initially, the default master is
active
, that is, it assumes the ARP
response and packet forwarding responsibilities for the virtual routers. The default backup is
inactive, but it is available to take over if it detects a failure on the default master.
In all cases, the assumption of the active role is managed by the
VRRP election
process. Past
the initialization stage, the role of active master is independent of the default condition. For
more information, see
Active master determination on page 119
.
Active master determination
VRRP ensures that one virtual router or the other assumes the role of active master.
VRRP
election
, the process that determines the active master, occurs during initialization (i.e., when
HA
or
AA
is enabled for the cluster) or during firewall startup.
VRRP failover
occurs when the
backup fails to receive advertisement packets at pre-set intervals from each interface on the
active master. Both processes ensure that only one firewall is active at a time and that it is able
to communicate on the LAN. Both processes are described below.
VRRP election
At startup, the virtual routers on both Switched Firewalls come up in the backup state and wait
for advertisement packets. When none are received (only active masters broadcast
advertisement packets), each virtual router assumes the active master role and both virtual
routers begin broadcasting advertisement packets. Once it detects advertisement packets from
the other master, the virtual router with the lower IP address (default backup) reverts to backup
leaving the virtual router with the higher IP address (default master) as the active master.
The active master continuously broadcasts advertisement packets at regular intervals defined
by the
adint
value. If advertisement packets are not received within the advertisement
interval, VRRP failover begins on the backup.
Some reasons why advertisement packets do not reach the backup include:
