User Manual Part 3

ManualsBrandsSonicwall ManualsElectronics802.11b/g/n Router

Page 50 Configuring High Availability

4. Select the Enable Virtual MAC checkbox. Virtual MAC

allows the Primary and Backup appliances to share a

single MAC address. This greatly simplifies the process of

updating network ARP tables and caches when a failover

occurs. Only the switch to which the two appliances are

connected needs to be notified. All outside devices will

continue to route to the single shared MAC address.

5. The Heartbeat Interval controls how often the two units

communicate. The default is 5000 milliseconds; the

minimum supported value is 1000 milliseconds.

6. Set the Failover Trigger Level to the number of

heartbeats that can be missed before failing over. By

default, this is set to 5 missed heartbeats.

7. Set the Probe Interval to the interval in seconds between

probes sent to specified IP addresses to monitor that the

network critical path is still reachable. This is used in logical

monitoring. SonicWALL recommends that you set the

interval for at least 5 seconds. The default is 20 seconds,

and the allowed range is 5 to 255 seconds. You can set the

Probe IP Address(es) on the High Availability >

Monitoring screen.

8. Set the Probe Count to the number of consecutive probes

before SonicOS Enhanced concludes that the network

critical path is unavailable or the probe target is

unreachable. This is used in logical monitoring. The default

is 3, and the allowed range is 3 to 10.

9. The Election Delay Time is the number of seconds

allowed for internal processing between the two units in the

HA pair before one of them takes the primary role. The

default is 3 seconds.

10. Select the Include Certificates/Keys checkbox to have

the appliances synchronize all certificates and keys.

11. You do not need to click Synchronize Settings at this

time, because all settings will be automatically

synchronized to the Idle unit when you click Accept after

completing HA configuration. To synchronize all settings on

the Active unit to the Idle unit immediately, click

Synchronize Settings. The Idle unit will reboot.

12. Click Synchronize Firmware if you previously uploaded

new firmware to your Primary unit while the Backup unit

was offline, and it is now online and ready to upgrade to the

new firmware. Synchronize Firmware is typically used

after taking your Backup appliance offline while you test a

new firmware version on the Primary unit before upgrading

both units to it.

13. When finished with all High Availability configuration, click

Accept. All settings will be synchronized to the Idle unit

automatically.

TZ_210_GSG.book Page 50 Friday, November 14, 2008 10:29 AM

Summary of content (15 pages)

PAGE 1
TZ_210_GSG.book Page 50 Friday, November 14, 2008 10:29 AM 4. 5. 6. 7. 8. 9. Select the Enable Virtual MAC checkbox. Virtual MAC allows the Primary and Backup appliances to share a single MAC address. This greatly simplifies the process of updating network ARP tables and caches when a failover occurs. Only the switch to which the two appliances are connected needs to be notified. All outside devices will continue to route to the single shared MAC address.
PAGE 2
TZ_210_GSG.book Page 51 Friday, November 14, 2008 10:29 AM Configuring HA Monitoring On the High Availability > Monitoring page, you can configure both physical and logical interface monitoring. By enabling physical interface monitoring, you enable link detection for the designated HA interfaces. The link is sensed at the physical layer to determine link viability.
PAGE 3
TZ_210_GSG.book Page 52 Friday, November 14, 2008 10:29 AM 6. In the Logical Probe IP Address field, enter the IP address of a downstream device on the LAN network that should be monitored for connectivity. Typically, this should be a downstream router or server. (If probing is desired on the WAN side, an upstream device should be used.) The Primary and Backup appliances will regularly ping this probe IP address. If both can successfully ping the target, no failover occurs.
PAGE 4
TZ_210_GSG.book Page 53 Friday, November 14, 2008 10:29 AM Verifying HA Functionality To verify that Primary and Backup SonicWALL security appliances are functioning correctly, wait a few minutes, then trigger a test failover by logging into the Primary unit and powering it off. The Backup SonicWALL security appliance should quickly take over. After a failover to the Backup appliance, all the pre-existing network connections must be re-established, including the VPN tunnels that must be re-negotiated.
PAGE 5
TZ_210_GSG.book Page 54 Thursday, November 13, 2008 7:41 PM Multiple ISP / WAN Failover and Load Balancing In this scenario, the SonicWALL TZ 210 is configured in NAT/Route mode to operate as a network gateway with multiple Internet Service Providers (ISPs) to allow load balancing and/or failover.
PAGE 6
TZ_210_GSG.book Page 55 Thursday, November 13, 2008 7:41 PM Configuring Secondary WAN Interface Activating and Configuring WAN Failover Perform the following steps to configure WAN Failover and Load Balancing on the SonicWALL security appliance: To configure the SonicWALL for WAN failover and load balancing, follow the steps below: 1. 1. On Network > Interfaces page, configure the chosen port to be in WAN zone, and enter the correct address settings provided by the Secondary ISP.
PAGE 7
TZ_210_GSG.book Page 56 Thursday, November 13, 2008 7:41 PM 3. Select a load balancing method. By default, the SonicWALL will select Basic Active/Passive Failover as the method, but there are four load balancing methods available: Basic Active/ Passive Failover Per Destination Round-Robin Spillover-Based PercentageBased Only sends traffic through the Secondary WAN interface if the Primary WAN interface has been marked inactive.
PAGE 8
TZ_210_GSG.book Page 57 Thursday, November 13, 2008 7:41 PM providing the connection to the ISP (also connected to this hub or switch) were to fail, the SonicWALL will continue to believe the WAN link is usable, because the connection to the hub or switch is good. Configuring WAN Probe Monitoring To configure WAN probe monitoring, follow these steps: 1. On the Network > WAN Failover & Load Balancing page, under the WAN Interface Monitoring heading, select the Enable Probe Monitoring checkbox. 2.
PAGE 9
TZ_210_GSG.book Page 58 Thursday, November 13, 2008 7:41 PM 4. If there is a NAT device between the two appliances sending and receiving TCP probes, the Any TCP-SYN to Port checkbox must be selected, and the same port number must be configured here and in the Configure WAN Probe Monitoring window. 5. Click on the Configure button. The Configure WAN Probe Monitoring window is displayed. 6.
PAGE 10
TZ_210_GSG.book Page 59 Thursday, November 13, 2008 7:41 PM Support and Training Options 6 In this Section: This section provides overviews of customer support and training options for the SonicWALL TZ 210 series appliances.
PAGE 11
TZ_210_GSG.book Page 60 Thursday, November 13, 2008 7:41 PM Customer Support Knowledge Portal SonicWALL offers Web-based and telephone support to customers who have a valid Warranty or who purchased a Support Contract. Please review our Warranty Support Policy for product coverage. SonicWALL also offers a full range of consulting services to meet your needs, from our innovative implementation services to traditional statement of work-based services.
PAGE 12
TZ_210_GSG.book Page 61 Thursday, November 13, 2008 7:41 PM Onboard Help SonicWALL Live Product Demos SonicOS features a dynamic Onboard Help in the form of helpful tooltips that appear over various elements of the GUI when the mouse hovers over them. Elements that display these tooltips include text fields, radio buttons, and checkboxes.
PAGE 13
TZ_210_GSG.book Page 62 Thursday, November 13, 2008 7:41 PM User Forums The SonicWALL User Forums is a resource that provides users the ability to communicate and discuss a variety of security and appliance subject matters.
PAGE 14
TZ_210_GSG.book Page 63 Thursday, November 13, 2008 7:41 PM Training SonicWALL offers an extensive sales and technical training curriculum for Network Administrators, Security Experts and SonicWALL Medallion Partners who need to enhance their knowledge and maximize their investment in SonicWALL Products and Security Applications.
PAGE 15
TZ_210_GSG.book Page 64 Thursday, November 13, 2008 7:41 PM Related Documentation See the following related documents for more information: • • • • • • • • • • SonicOS Enhanced Administrator’s Guide SonicOS Enhanced Release Notes SonicOS Enhanced Feature Modules • Dashboard • High Availability • Multiple Admin • NAT Load Balancing • Packet Capture • Radio Frequency Monitoring • Single Sign-On • SSL Control • Virtual Access Points SonicWALL GMS 5.0 Administrator’s Guide SonicWALL GVC 4.