Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
Redundant Firewalls
129
213455-L, October 2005
8.
If you have NATing enabled in any of the VRRP interface, make sure VRRP packets
(packets destined for 224.0.0.18) are not NATed. You can add this as the first manual
NATing rule.
Configuring the redundant Switched Firewall
The commands in this example use the parameters in
Figure 58 on page 126
. Your
configuration may differ but it should observe the same configuration patterns as in the
example.
1.
Log in as the administrator.
2.
When the Setup Menu appears, select
join
and enter the basic configuration
parameters, when prompted (see
Setting up the basic configuration on page 37
).
Enter a unique IP address, but enter the same MIP you used for firewall 1.
3.
Reboot and log back into NSF#1 to complete the VRRP configuration on both Switched
Firewalls.
N
OTE
–
The Nortel Single System Image (SSI) maps the Switched Firewall configuration
across both firewalls in the cluster. That is, whatever you had configured for firewall NSF#1
previously is mapped to firewall NSF#2 and any changes you add when logged into firewall
NSF#1 are mapped to firewall NSF#2. This ensures that the configuration of both firewalls is
identical, a prerequisite for VRRP to work.
Note also that you must enter license information manually per firewall and that you must push
policies to each firewall individually.
N
OTE
–
You must configure the vrid, ip1, ip2, addr1, and addr2 for each defined interface
(except the Sync interface). Otherwise, active-standby (high availability) or active-active does
not work on any interface.
