Limitations of Cluster Addresses on Different Subnets

This new feature does not yet support all the capabilities of ClusterXL. Some features require additional configuration to work properly, while others are not supported.

Connectivity Between Cluster Members

Since ARP requests issued by Cluster Members are hidden behind the cluster IP and MAC addresses, requests sent by one Cluster Member to the other may be ignored by the destination computer. To allow Cluster Members to communicate with each other, a static ARP should be configured for each Cluster Member, stating the MAC addresses of all other Cluster Members. IP packets sent between Cluster Members are not altered, and therefore no changes should be made to the routing table.

Note - Static ARP is not required in order for the Cluster Members to work properly as a cluster, since the cluster synchronization protocol does not rely on ARP.

Load Sharing Multicast Mode with "Semi-Supporting" Hardware

Although not all types of network hardware work with multicast MAC addresses, some routers can pass such packets, even though they are unable to handle ARP Replies containing a multicast MAC address. Where a router semi-supports Load Sharing Multicast mode, it is possible to configure the cluster MAC address as a static ARP entry in the router internal tables, and thus allow it to communicate with the cluster.

When different subnets are used for the cluster IP addresses, static ARP entries containing the router MAC address need to be configured on each Cluster Member. This is done because this kind of router will not respond to ARP Requests containing a multicast source MAC address. These special procedures are not required when using routers that fully support multicast MAC addresses.

Manual Proxy ARP

When using Static NAT, the cluster can be configured to automatically recognize the hosts hidden behind it, and issue ARP replies with the cluster MAC address, on their behalf. This process is known as Automatic Proxy ARP.

However, if you use the ClusterXL VMAC mode or different subnets for the cluster IP addresses, this mechanism will not work, and you must configure the proxy ARP manually. To do so, in SmartConsole, select Menu > Global Properties > NAT Network Address Translation, and disable Automatic ARP Configuration. Then create a file $FWDIR/conf/local.arp.

For instructions, see sk30197.

Connecting to the Cluster Members from the Cluster Network

Since the unique IP addresses may be chosen arbitrarily, there is no guarantee that these addresses are accessible from the subnet of the cluster IP address. In order to access the Cluster Members through their unique IP addresses, you must configure routes on the accessing Cluster Member, such that the cluster IP is the Default Gateway for the subnet of the unique IP addresses.

Configuring Anti-Spoofing

1. In SmartConsole, define a Group object, which contains the objects of both the external network and the internal network.

   In the example, suppose Side "A" is the external network, and Side "B" is the internal network.

   You must define a Group object, which contains both network 172.16.4.0 and network 192.168.2.0.

2. Open the cluster object.
3. Go to Network Management pane.
4. Select the cluster interface and click Edit.
5. On the General page, in the Topology section, click Modify.
6. Select Override.
7. Select This Network (Internal).
8. Select Specific and select the Group object that contains the objects of both the external network and the internal network.
9. Click OK.
10. Install the Access Control Policy on this cluster object.