User manual BARRACUDA BARRACUDA SSL VPN CLUSTERING FOR HIGH AVAILABILITY

[. . . ] Clustering for High Availability Barracuda SSL VPN Clustering two or more Barracuda SSL VPNs together provides you with a high availability, fault-tolerant environment that supports data redundancy and centralized policy management. Easily scalable simply by linking in additional devices, clustered Barracuda SSL VPNs are also easy to configure -- once you configure one of the devices, configuration settings are synchronized across the cluster almost immediately. Clustering for High Availability is available on the Barracuda SSL VPN 380 and higher. [. . . ] Log in as "admin" and go to the BASIC > IP Configuration page. Check the "Operating Mode" section -- if it is not already set to Bridge-Path, click "Convert" to change the operation from Route-Path to Bridge-Path, and reboot. Configure the Barracuda Load Balancer to have a Virtual IP address (VIP) that points to your pool of SSL VPNs. The WAN side of the Barracuda Load Balancer will have two IP addresses we need to consider: the Barracuda Load Balancer system IP address and the VIP that the cluster will use. For example: Network 10. 5. 0. 0/17 10. 5. 0. 0/17 17-090820-02-0618 Barracuda Load Balancer WAN Port System IP Virtual IP IP Address 10. 5. 16. 8 10. 5. 4. 17 Notes The primary system IP address, used to configure the Barracuda Load Balancer. The Virtual IP that points to the cluster. Page 1 of 4 Copyright © 2004-2010, Barracuda Networks Inc. Clustering for High Availability Barracuda SSL VPN Once the Barracuda SSL VPNs are configured with their IP addresses and the Barracuda Load Balancer is configured with its WAN management and virtual IP addresses, it's time to configure the Virtual IP in the Barracuda Load Balancer. To configure the VIP on the Barracuda Load Balancer: 1. Navigate to BASIC > Services and add a new Service, using the IP address of the actual Barracuda SSL VPN servers on port 80 as shown below: 2. Edit the Virtual IP service entry. 3. From this page, provide the SSL termination and determine session persistence. In this example Layer 4 (Client IP) persistence is used and the persistence timeout value is set for one day. Copyright © 2004-2010, Barracuda Networks Inc. 17-090820-02-0618 Page 2 of 4 Clustering for High Availability Barracuda SSL VPN Configuring the Barracuda SSL VPNs Prior to clustering your Barracuda SSL VPNs, make sure you do the following: o Create a backup of your existing Barracuda SSL VPN configuration. This is to ensure that your configurations are not lost in case something goes wrong. o Ensure all Barracuda SSL VPNs are running the same firmware version. If they are not, upgrade your systems to the latest firmware prior to clustering. To cluster your Barracuda SSL VPNs: 1. [. . . ] If not all systems are showing a green light, wait a minute or two for the clustering process to complete then refresh the page again. Copyright © 2004-2010, Barracuda Networks Inc. 17-090820-02-0618 Page 3 of 4 Clustering for High Availability Barracuda SSL VPN Setting non-proxied hosts If the Barracuda SSL VPNs are using a proxy (BASIC > IP Configuration), then you must also configure non-proxy hosts in the Barracuda SSL VPN interface on port 443. To do this, log onto the Barracuda SSL VPN interface on all servers and from the ADVANCED > Configuration > Proxies page, make sure there is a non-proxied host entry for your IP range that the clustered servers are on (e. g. Without this setting, data synchronization may not occur and your systems will not be truly clustered. Copyright © 2004-2010, Barracuda Networks Inc. 17-090820-02-0618 Page 4 of 4 [. . . ]