9
High Availability
166
HA issues
The
following
points
should
be
kept
in
mind
when
managing
and
configuring
an
HA
cluster.
All cluster interfaces need IP addresses
All
interfaces
on
both
HA
cluster
units
should
have
a
valid
private
IP
address
object
assigned
to
them.
The
predefined
IP
object
local
host
could
be
assigned
for
this
purpose.
The
requirement
to
assign
an
address
is
true
even
if
an
interface
has
been
disabled.
SNMP
SNMP
statistics
are
not
shared
between
master
and
slave.
SNMP
managers
have
no
failover
capabilities.
Therefore
both
security
gateways
in
a
cluster
need
to
be
polled
separately.
Logging
Log
data
will
be
coming
from
both
master
and
slave.
This
means
that
the
log
receiver
will
have
to
be
configured
to
receive
logs
from
both.
It
also
means
that
all
log
queries
will
likely
have
to
include
both
master
and
slave
as
sources
which
will
give
all
the
log
data
in
one
result
view.
Normally,
the
inactive
unit
will
not
be
sending
log
entries
about
live
traffic
so
the
output
should
look
similar
to
that
from
a
single
security
gateway.
Using private individual IP addresses
The
unique
individual
IP
addresses
of
the
master
and
slave
cannot
safely
be
used
for
anything
but
management.
Using
them
for
anything
else,
such
as
for
source
IPs
in
dynamically
address
translated
connections
or
publishing
services
on
them,
will
inevitably
cause
problems
since
unique
IPs
will
disappear
when
the
security
gateway
they
belong
to
does.
Changing the cluster ID
Changing
the
cluster
ID
in
a
live
environment
is
not
recommended
for
two
reasons.
First,
this
will
change
the
hardware
address
of
the
shared
IPs
and
will
cause
problems
for
all
units
attached
to
the
local
LAN,
as
they
will
keep
the
old
hardware
address
in
their
ARP
caches
until
it
times
out.
Such
units
would
have
to
have
their
ARP
caches
flushed.
Second,
this
breaks
the
connection
between
the
security
gateways
in
the
cluster
for
as
long
as
they
are
using
different
configurations.
This
will
cause
both
gateways
to
go
active
at
the
same
time.
HA limitations with IPsec
Established
IPsec
tunnels
are
preserved
during
an
HA
failover.
However,
the
IKE
negotiation
phase
of
tunnel
setup
is
not
preserved
by
a
failover.
In
this
case,
the
tunnel
will
need
to
be
set
up
again
from
the
beginning.
