1

Synchronize the system time on all Security Gateways to be included in this Virtual Router.

Best Practice - We recommend that you enable NTP (Network Time Protocol) on all Security Gateways.

You can also manually change the time and time zone on each Security Gateway to match the other members.
In this case, you must synchronize member times to within a few seconds.

2

Optional: Add host names and IP address pairs to the host table on each Security Gateway.

This lets you use host names as an alternative to IP addresses or DNS servers.

1

Install Gaia using the instructions in the R80.20 Installation and Upgrade Guide.

2

On the First Time Configuration Wizard Products page, select Security Gateway.

Do not select Security Management. The standalone environment (Security Gateway and Security Management Server) is not supported for VRRP.

3

Select Unit is part of a cluster.

4

Select VRRP Cluster from the list.

5

Continue with the next steps in the wizard.

6

When prompted to reboot the Security Gateway, click Cancel.

Do not reboot.

7

Do one of these steps:

• Run cpconfig on the Security Gateway. Select Enable cluster membership for this gateway to enable State synchronization.

  Note - This is the most common use and does not support active/active mode. You must configure VRRP so that the same cluster member is the VRRP master on all interfaces. Dynamic routing configuration must match on each cluster member.

• Do not enable ClusterXL.

  Note - This is useful when each cluster member is required to be the VRRP master at the same time. You can configure two VRRP Virtual Routers on the same interface. Each cluster member can be the VRRP master for a different VRID on the same interface while it backs up the other. This configuration can also help run VRRP in a High-Availability pair with a device from another vendor. Disable the VRRP monitoring of the Firewall when you use this configuration. It is enabled by default but, but not supported with this configuration. In addition, only Static Routes are supported with this configuration.

8

Enter y when prompted.

9

Reboot the Security Gateway.

1

In the navigation tree, click High Availability > VRRP.

2

Refer to the VRRP Global Settings section.

3

If the Disable All Virtual Routers option is currently selected, clear it.

4

Click Apply Global Settings.

1

In the navigation tree, click one of these:

• High Availability > VRRP.
• High Availability >Advanced VRRP.

2

In the VRRP Global Settings section:

• Cold Start Delay - Configures the delay period in seconds before a Security Gateway joins a Virtual Router. Default = 0.
• Interface Delay - Configure this when the Preempt Mode of VRRP was turned off. This is useful when the VRRP node with a higher priority is rebooted, but must not preempt the existing VRRP Master that is handling the traffic, but is configured with a lower priority. Sometimes interfaces that come up take longer than the VRRP timeout to process incoming VRRP Hello packets. The Interface Delay extends the time that VRRP waits to receive Hello packets from the existing VRRP Master.
• Disable All Virtual Routers - Select this option to disable all Virtual Routers defined on this Gaia system. Clear this option to enable all Virtual Routers. By default, all Virtual Routers are enabled.
• Monitor Firewall State - Select this option to let VRRP monitor the Security Gateway and automatically take appropriate action. This is enabled by default, which is the recommended setting when using VRRP with ClusterXL enabled. This must be disabled when using VRRP with ClusterXL disabled.

  Important - If you disable Monitor Firewall State, VRRP can assign VRRP Master status to a Security Gateway before it completes the boot process. This can cause more than one Security Gateway in a Virtual Router to have VRRP Master status.

3

Click Apply Global Settings.