User manual SONICWALL SONICOS 5.6.5 ACTIVE-ACTIVE CLUSTERING

[. . . ] Active/Active Clustering in SonicOS 5. 6. 5 Document Scope This document provides conceptual information and describes how to configure and use the Active/Active Clustering feature in SonicOS 5. 6. 5. This document contains the following sections: · · · · · · · "Feature Overview" section on page 1 "Prerequisites" section on page 16 "Configuration Task List" section on page 19 "Physically Connecting Your Appliances" section on page 20 "Configuring Active/Active Clustering and High Availability" section on page 23 "Verifying Active/Active Clustering Configuration" section on page 37 "Related Features" section on page 41 Feature Overview This section provides an introduction to the Active/Active Clustering feature. This section contains the following subsections: · · · · "What is Active/Active Clustering?" section on page 1 "Benefits of Active/Active Clustering" section on page 3 "How Does Active/Active Clustering Work?" section on page 4 "Platform and Feature Support Information" section on page 13 What is Active/Active Clustering? This section provides a brief overview of the following topics: · · "Background: High Availability in SonicOS" on page 2 "Active/Active Clustering in SonicOS 5. 6. 5. 0" on page 3 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 1 Feature Overview Background: High Availability in SonicOS Stateless High Availability The first SonicWALL High Availability solution allowed two identical SonicWALL security appliances running the same version of SonicOS Enhanced to be configured as a High Availability Pair (HA pair) to provide a reliable, continuous connection to the public Internet. In the event of the failure of the Primary SonicWALL in an HA pair, the Backup SonicWALL takes over to secure a reliable connection between the protected network and the Internet. [. . . ] For information about configuring and using the individual management IP address of each appliance, see "About High Availability Monitoring" on page 11 and "Configuring High Availability Monitoring" on page 31. Licensing High Availability Features Active/Active Clustering, Stateful High Availability, and Active/Active DPI licenses are included on registered SonicWALL NSA E-Class appliances. Because Active/Active Clustering is supported only on E-Class appliances, you do not need to purchase any additional licenses to use these High Availability features in SonicOS 5. 6. 5. Note Active/Active Clustering and Stateful High Availability licenses must be activated on each appliance, either by registering the unit on MySonicWALL from the SonicOS management interface, or by applying the license keyset to each unit if Internet access is not available. You can view system licenses on the System > Licenses page of the management interface. This page also provides a way to log into MySonicWALL. When the SonicWALL security appliances in the Active/Active cluster have Internet access, each appliance in the cluster must be individually registered from the SonicOS management interface while the administrator is logged into the individual management IP address of each appliance. This allows the Backup units to synchronize with the SonicWALL licensing server and share licenses with the associated Primary appliances in each HA pair. There is also a way to synchronize licenses for an HA pair whose appliances do not have Internet access. When live communication with SonicWALL's licensing server is not permitted due to network policy, you can use license keysets to manually apply security services licenses to your appliances. When you register a SonicWALL security appliance on MySonicWALL, a license keyset is generated for the appliance. If you add a new security service license, the keyset is updated. However, until you apply the licenses to the appliance, it cannot perform the licensed services. Note In a High Availability deployment without Internet connectivity, you must apply the license keyset to both of the appliances in the HA pair. You can use one of the following procedures to apply licenses to an appliance: · · "Activating Licenses from the SonicOS User Interface" on page 18 "Copying the License Keyset from MySonicWALL" on page 18 SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 17 Prerequisites Activating Licenses from the SonicOS User Interface Follow the procedure in this section to activate licenses from within the SonicOS user interface. Perform the procedure for each of the appliances in a High Availability Pair while logged into its individual LAN management IP address. See "Configuring High Availability Monitoring" on page 31 for information about configuring the individual IP addresses. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Log in to the SonicOS user interface using the individual LAN management IP address for the appliance. On the System > Licenses page, under Manage Security Services Online, click the link for To Activate, Upgrade or Renew services, click here. In the Licenses > License Management page, type your MySonicWALL user name and password into the text boxes. On the Systems > Licenses page under Manage Security Services Online, verify the services listed in the Security Services Summary table. Repeat this procedure for the other appliance in the HA pair. Copying the License Keyset from MySonicWALL You can follow the procedure in this section to view the license keyset on MySonicWALL and copy it to the SonicWALL security appliance. Perform the procedure for each of the appliances in a High Availability Pair while logged into its individual LAN management IP address. See "Configuring High Availability Monitoring" on page 31 for information about configuring the individual IP addresses. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Login to your MySonicWALL account at <https://www. mysonicwall. com/>. In the left navigation pane, click My Products. On the My Products page, under Registered Products, scroll down to find the appliance to which you want to copy the license keyset. [. . . ] See the following: · · · · · "Comparing CPU Activity on Appliances in a Cluster" on page 37 "Verifying Settings in the High Availability > Status Page" on page 38 "Additional Parameters in TSR" on page 39 "Responses to DPI Matches" on page 40 "Logging" on page 40 Comparing CPU Activity on Appliances in a Cluster On the active firewall of the Master node, the System > Diagnostics page with Multi-Core Monitor selected shows the activity of all appliances in the Active/Active cluster. Figure 15 displays the Multi-Core Monitor on an Active/Active cluster with Active/Active DPI enabled. This configuration utilizes all units in the cluster for the highest possible performance. Figure 15 System > Diagnostics Page for Multi-Core Monitor When Active/Active DPI is enabled on a Stateful HA pair, you can observe a change in CPU utilization on appliances in the HA pair. CPU activity goes down on the active unit, and goes up on the idle unit. SonicOS 5. 6. 5 Active/Active Clustering Feature Guide 37 Verifying Active/Active Clustering Configuration When viewing the Multi-Core Monitor on an active unit in the cluster, all firewalls in the cluster are displayed. [. . . ]