Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
Redundant Firewalls
123
213455-L, October 2005
N
OTE
–
A rule to allow VRRP multicast packets to and from the virtual router sub-addresses
on both firewalls must be configured at the Check Point SmartDashboard. If the policy is not
properly implemented, both firewalls assume the role of active master (see
SmartDashboard
configuration on page 85
).
It may be necessary to increase the
adint
value during high traffic periods that prevent the
active firewall from issuing advertisement messages at the specified interval. Increasing the
adint
value lowers the chance for unnecessary disruption of packet forwarding, but increases
the length of service disruption in the event that the active master fails.
Gratuitous ARP (GARP)
Once the backup detects a failure in the active master, the backup immediately flashes a
Gratuitous ARP (GARP) message to the end-hosts on the virtual router interface. The GARP
(an unsolicited ARP response) forces end-hosts to update their ARP caches with the new MAC
address/IP address mapping. Then the backup delays a period of time defined by the
/cfg/net/vrrp/garp
(GARP delay) value before sending continuous GARP messages at
intervals defined by the
/cfg/net/vrrp/gbcast
(Gratuitous Broadcast) value.
Continuous GARP messages prevent end-hosts from aging out their ARP entries for the virtual
router.
The flash GARP message shortens the ‘black hole’ period, that is, the time it takes a device to
discover a lost neighbor. (One of the goals of a properly implemented VRRP backup strategy
is to keep black hole periods short for end-hosts.)
Increasing the gbcast value cuts down on the GARP traffic, but lengthens the interval between
end-host ARP cache updates.
VRRP interface
Virtual router interface parameters are defined per virtual router at the VRRP Interface Menu
(see
page 330
) or the Network/Interfaces/Update (Add or Modify) form in the
Nortel
Switched
Firewall 5100 Series BBI User’s Guide
. Before you configure them, you must first configure
the interface IP parameters at the Interface Menu
(see
page 328
).
Each virtual router interface
requires the following parameters:
A common
virtual router IP address
A common
virtual router ID
(vrid)
Two sub-addresses (one representing each firewall host)
A common port on each firewall
