Configuring High Availability

Background

ClusterClosed Two Quantum Spark Appliances connected to each other for High Availability. maintains connections in the organization's network when there is a failure in one of the Cluster Members. The cluster provides redundancy.

In the Device view > Advanced section > High Availability page you can create a cluster of two appliances for high availability.

After you configure a cluster, you can select to Enable or Disable the cluster.

Notes:

  • This release supports only the High Availability Cluster.

    One Cluster MemberClosed A Security Gateway that is part of a cluster. is Active. The other Cluster Member is Standby.

    If there is a failure on the Active Cluster Member, the cluster fails over, and the current Standby Cluster Member becomes the new Active Cluster Member.

  • After you configure the cluster, when you connect to the Cluster Virtual IP address, the cluster automatically redirects you to the current Active Cluster Member.

    To log in to specific Cluster Member, you must connect to the physical IP address of that Cluster Member.

Limitations

  • You cannot create a cluster when you have a switch or bridge defined in the network settings on the appliance. If necessary, change network settings in the Device > Local Network page.

  • It is not supported to configure a Cluster of Quantum Spark Appliances when an Internet connection is a Bond interface.

  • Cluster requires Static IP addresses on the physical cluster interfaces.

  • Cluster does not support pure IPv6 addresses on cluster interfaces (you must also configure IPv4 addresses).

  • All cluster configuration is done through the Active Cluster Member. The WebUI of the Standby Cluster Member only has some options available for fine tuning - basic network settings, and logs (a cluster managed by Quantum Spark Portal cluster also has Cloud Services).

  • After you configure a cluster, these interface settings are not available in WebUI for the Active and Standby members:

    • Device view > Network section > Local Network page > interface properties

      • The Advanced tab

      • The DHCPv4 Settings tab

      • The Configuration tab > DHCPv4 Server section:

        • IP addresses exclude range

        • Relay

    • Device view > Network section > Internet page > Internet connection properties

      • The Connection Monitoring tab > list of servers to probe with ping

      • The Advanced tab - All settings, except ISP Redundancy

    To configure these settings, use the equivalent CLI commands on each Cluster Member (these settings are not synchronized).

Prerequisites

  • In WebUI > Device > Local Network, delete bridge and switch configurations before you start to configure a cluster.

  • The appliances in a cluster must have the same hardware, firmware (version and build), and licenses.

    Note - Connect the sync cables only after you complete the First Time Configuration Wizard and remove the switch on both appliances. No additional configuration is required on the members.

Best Practice - Designate the same LAN port for the Sync interface. The default Sync interface is LAN2/SYNC.

Configuration Workflow

  1. Complete the First Time Configuration Wizard on both appliances.

    In the Local Network page of the wizard, clear the Enable switch on LAN ports checkbox.

  2. Configure network settings on the appliance that is the primary Cluster Member.

  3. Connect cables between the Sync interfaces on the appliances.

    Note - You can also connect single physical Sync ports (non-Bond) through a switch.

  4. Configure the primary Cluster Member.

    1. Connect to the WebUI on the appliance.

    2. From the left navigation panel, click Device.

    3. In the Advanced section, click the High Availability page.

    4. Click Configure Cluster.

      The New Cluster Wizard opens.

    5. On the page Step 1: Gateway Priority:

      1. Select Configure as primary member.

      2. Click Next.

    6. On the page Step 2: SIC Settings:

      1. In the section Secure Internal Communication, in the fields Password and Confirm, enter a password for connecting the two Cluster Members to each other.

        Note - You cannot use these characters in a password or shared secret: { } [ ] ` ~ | ‘ " \ (maximum number of characters: 255)

      2. Open the section Advanced.

      3. Configure the required settings for the Sync interface (by default, LAN2).

        Important - The configuration on the secondary Cluster Member must match the configuration on the primary Cluster Member.

      4. Click Next.

    7. On the page Step 3: Gateway Interfaces (<X> out of <Y>):

      On these pages, you configure the "internal" and "external" cluster interfaces.

      Note - The physical IP addresses of cluster interfaces and the cluster Virtual IP address must be in the same subnet unless you are configuring a Single Routable IP Cluster.

      1. Select Enable High Availability on interface (this is the default).

        If you enable the high availability on an interface, the primary Cluster Member monitors it and if there is a failure, it automatically fails over to the secondary Cluster Member.

        If you clear this option, then you can also clear the option Monitor interface state (fail over when interface is down) to stop the cluster monitoring completely.

      2. In the field Cluster IP address, configure the applicable cluster Virtual IP address. All hosts and network devices on the corresponding connected network must send their traffic to this Virtual IP address as their default gateway.

      3. In the field Subnet mask, configure the applicable subnet mask for the cluster Virtual IP address.

      4. In the field Primary physical IP address, the wizard shows the IP address configured on the interface.

      5. In the field Secondary physical IP address, configure the applicable IP address.

      6. Click Next.

    8. Click Finish.

    Note - At the top of the page, the Peer gateway field shows "is not defined". This status changes after you finish configuring the secondary Cluster Member.

    Watch the Video

  5. Configure the secondary Cluster Member.

    1. Connect to the WebUI on the appliance.

    2. From the left navigation panel, click Device.

    3. In the Advanced section, click the High Availability page.

    4. Click Configure Cluster.

      The New Cluster Wizard opens.

    5. On the page Step 1: Gateway Priority:

      1. Select Configure as secondary member.

      2. Click Next.

    6. On the page Step 2: SIC Settings:

      1. Open the section Advanced.

      2. Configure the required settings for the Sync interface.

        Important - The configuration on the secondary Cluster Member must match the configuration on the primary Cluster Member.

      3. In the section Secure Internal Communication, in the field Password, enter the same password you configured in the New Cluster Wizard on the primary Cluster Member.

      4. In the section Secure Internal Communication, click Establish Trust.

      5. Click Finish.

    7. The secondary Cluster Member fetches the settings from the primary Cluster Member and applies them.

    Watch the Video

Viewing Cluster Interfaces

  1. Connect to the WebUI on a Cluster Member:

    https://<IP Address of the Cluster Member>:4434

    Best Practice - After the cluster is successfully configured, connect to https://<Virtual IP Address of the Cluster>:4434. This redirects you to the WebUI Home > System page for the active Cluster Member.

  2. From the left navigation panel, click Device.

  3. In the Advanced section, click the High Availability page.

  4. The table List of Configured Interfaces shows information about the cluster interfaces:

    Column

    Description

    Name

    Name of the interface.

    Status

    Cluster status of the interface:

    Status

    Description

    High Availability

    Two physical interfaces in 2 Cluster Members act as a single interface toward the network, using a single virtual IP address.

    Note - In this cluster solution, each interface has a local IP address in addition to the shared single virtual IP address.

    Sync

    Two physical interfaces must be defined as Sync interfaces and connected between the members to allow proper failover as needed. The default is to use LAN2/Sync physical port.

    Non HA

    This status is also called private.

    The physical interface in this member does not participate in High Availability functions.

    Monitored

    This status is also called private monitored.

    The physical interface on this Cluster Member is not coupled with another interface on the other Cluster Member as in High Availability interface mode.

    The interface's status is still monitored, and if a problem occurs, the Cluster Member fails over to the other Cluster Member.

    IP Address

    Cluster Virtual IP address configured on the interface.

    Member IP Address

    Physical IP address configured on the interface.

Viewing the Cluster Status

  1. Connect to the WebUI on a Cluster Member:

    https://<IP Address of the Cluster Member>:4434

    Best Practice - After the cluster is successfully configured, connect to https://<Virtual IP Address of the Cluster>:4434. This redirects you to the WebUI Home > System page for the active Cluster Member.

  2. From the left navigation panel, click Device.

  3. In the Advanced section, click the High Availability page.

  4. Click View diagnostics.

Failing Over Manually

  1. Connect to the WebUI on the primary Cluster Member:

    https://<IP Address of the Primary Cluster Member>:4434

  2. From the left navigation panel, click Device.

  3. In the Advanced section, click the High Availability page.

  4. Click Force Member Down.

    A confirmation message appears.

  5. Click Yes.

  6. Cluster State:

    • The primary Cluster Member is now Down.

    • The secondary Cluster Member is now Active.

  7. The primary Cluster Member logs you out from Web UI because it has to reload it (to show only the supported pages).

Notes:

  • Only one Cluster Member can be down at a time.

    For the Cluster Member in the Down state, the Force Member Down button becomes Disable Manual Failover.

  • If you want the primary Cluster Member to handle the traffic, you must fall back from the secondary Cluster Member to the primary Cluster Member.

  1. Connect to the WebUI on the primary Cluster Member:

    https://<IP Address of the Primary Cluster Member>:4434

  2. From the left navigation panel, click Device.

  3. In the Advanced section, click the High Availability page.

  4. Click Disable Manual Failover.

    A confirmation message shows.

  5. Click Yes.

    The original primary Cluster Member is now the Active Cluster Member.

Changing Network Configuration of Cluster Members

  1. Reset the cluster configuration on the secondary Cluster Member.

    See Resetting Cluster Configuration.

  2. On the primary Cluster Member, change the configuration.

  3. On the primary Cluster Member, click Reinitialize Trust.

  4. Reconnect the secondary Cluster Member, which fetches the new configuration.

Resetting Cluster Configuration

  1. Connect to the WebUI on one of the Cluster Members:

    https://<IP Address of the Cluster Member>:4434

  2. From the left navigation panel, click Device.

  3. In the Advanced section, click the High Availability page.

  4. Click Reset Cluster Configuration.

Important - This deletes all cluster configuration settings from both Cluster Members. You must run the New Cluster Wizard again to configure the cluster.

Upgrading a Cluster Manually

Notes:

  1. Only manual local upgrade is supported.

  2. Upgrade each Cluster Member individually.

  3. Start the upgrade on the Standby Cluster Member.

  4. After the upgrade, the appliance automatically reboots and changes its cluster state to Active.

  5. Start the upgrade on the new Standby Cluster Member (former Active).

  1. Upgrade the current Standby Cluster Member:

    1. Connect to the WebUI on a Cluster Member:

      https://<IP Address of the Cluster Member>:4434

    2. From the left navigation panel, click Device.

    3. In the Advanced section, click the High Availability page.

    4. At the top of this page, examine the cluster state.

      If the current cluster state shows "This gateway (<...>) is standby", then continue to the next step.

      Otherwise, connect to the other Cluster Member

    5. In the System section, click the System Operations page.

    6. Click Manual Upgrade.

      The Upgrade Software Wizard opens.

    7. Follow the wizard instructions.

    8. Standby Cluster Member reboots automatically and changes its cluster state to Active.

  2. Upgrade the new Standby Cluster Member (former Active Cluster Member):

    1. Connect to the WebUI on the Cluster Member:

      https://<IP Address of the High Availability>:4434

    2. From the left navigation panel, click Device.

    3. In the Advanced section, click the High Availability page.

    4. At the top of this page, examine the cluster state.

      Wait for the current cluster state to show "This gateway (<...>) is standby", and then continue to the next step.

    5. In the System section, click the System Operations page.

    6. Click Manual Upgrade.

      The Upgrade Software Wizard opens.

    7. Follow the wizard instructions.

    8. This Standby Cluster Member reboots automatically and keeps the cluster state Standby.

Single Routable IP Cluster

You can configure a Single Routable IP cluster where the virtual IP address is in a different subnet than the physical IP addresses of the Cluster Members. Only the virtual IP address is routable. Traffic sent from Cluster Members to internal or external networks is hidden behind the cluster Virtual IP address.

Advantages of using different subnets:

  • Use only one Virtual IP address for the cluster.

  • Hide physical Cluster Members' IP addresses behind the cluster Virtual IP address.

  • Create a cluster in an existing subnet that has a limited number of available IP addresses.

  • The Internet connection must be of type Static.

  • The IP address of the Internet connection must be a fake, non-routable on the same subnet as the Internet Connection of the other member. For example, the IP address of the Internet connection of the first member is 4.4.4.4 with subnet of 255.255.255.0, and the IP address of the second member is subnet 255.255.255.0.

  • When first configuring the Internet connection, you must configure a default gateway. This gateway IP address must be fake as well and in the same subnet as the Cluster Members' IP addresses. In our example, 4.4.4.1.

  • You must turn off probe monitoring:

    1. Click Edit to open the Edit Internet Connection window > Connection Monitoring tab.

    2. Clear all probing checkboxes.

  • You must turn off SD-WAN (supported starting from R81.10.10).

  1. Configure the primary and secondary Cluster Members as for a regular cluster (see Configuration Workflow) but with these differences:

    1. On the primary member: In Step 2 of the Cluster Wizard, when you configure the password for establishing trust, do not configure specific IP addresses for Sync interfaces. As a result, the default IP address is used as the Sync interface.

    2. After you configure the secondary member:

      1. Go back to the primary (Active) member and click Edit.

      2. Set the Default gateway as the default gateway of the Virtual IP address subnet.

    3. For each Cluster Member, in the Connection Monitoring tab, click the checkboxes to restore the probing options.

    4. If SD-WAN is supported, turn it on.

  2. Click Save to save your changes.

The related route to the Virtual IP address subnet shows in the Routing Table.

Cluster Managed by Spark Management

You can configure a cluster in which both gateways are managed by Spark Management on the Infinity Portal.

Make sure the gateways are connected to Spark Management before you configure the cluster.

A cluster supported by Spark Management is very similar to a Locally Managed cluster. One member is Active, and the other is Standby. To change the status of the Active member, click Force Member Down.

The configuration procedure is the same as for the Locally Managed cluster:

  1. See Limitations.

  2. See Prerequisites.

  3. Follow Configuring High Availability.

  4. Follow Configuring High Availability.

Important - When you manage the cluster with Spark Management, the cluster does not synchronize connections. In the event of a cluster failover, you must re-establish the connections.