Verify General Functionality

Setup a client on the LAN and ensure that it receives a DHCP IP address and that it shows the LAN CARP VIP as its gateway and DNS server. Verify that the client can reach the Internet and otherwise function as expected.

Verify XMLRPC Sync is working

XMLRPC Configuration Synchronization can be tested several ways. The easiest method is to make a change to any supported area on the primary, such as a firewall rule, and then see if the change is reflected on the secondary after a few moments.

The manual method for forcing a synchronization task to test XMLRPC is to visit Status > Filter Reload on the primary node and click Force Config Sync. The status will change briefly and then if everything is working properly, a message will be displayed indicating the sync completed successfully.

Verify CARP is working

Visit Status > CARP on both nodes to check if CARP is functional. The primary node will display “MASTER” for all CARP VIPs and the secondary will display “BACKUP” for all CARP VIPs. If the status screen indicates that CARP is disabled, press the Enable CARP button.

Verify State Synchronization is working

The Status > CARP page lists pfsync nodes which give an indication of the state synchronization status. The values may not always match identically on both nodes, but they will be close. If the two are very different, it can indicate a problem with state synchronization. If they are identical or nearly identical, then state synchronization is working.

Testing Failover

A manual failover test may be initiated in one of four ways:

1. Click Temporarily Disable CARP on Status > CARP on the primary node. This will disable CARP temporarily, and if the primary node is rebooted it will turn back on. Click Enable CARP to turn it back on.
2. Click Enter Persistent CARP Maintenance Mode on Status > CARP on the primary node. This will disable CARP persistently, even if the primary node is rebooted. To exit maintenance mode, click Leave Persistent CARP Maintenance Mode to enable CARP once again.
3. Unplug a network cable from an interface with a CARP VIP present, such as WAN or LAN. This will trigger a failover event. Plug the cable back in to recover.
4. Shut down or reboot the primary node.

During any of the above tests, visit Status > CARP on the secondary to confirm that the CARP VIPs have taken over and show a “MASTER” status.

Before, during, and after triggering a failover, test connections from a client on the LAN through to the Internet to ensure connectivity works at each step. Downloading a file, streaming audio, or streaming video will most likely continue uninterrupted. VoIP-based phone calls may have a slight disruption as they are not buffered like the others.

Also have a client attempt to obtain an IP address by DHCP while running from the secondary.

If VPNs or other services have been configured, check those during the test as well to ensure the VPN established on the secondary node and continues to pass traffic.

Once the primary node has returned to “MASTER” status, ensure everything continues to work.

Assumptions

This guide assumes that:

• Only two cluster nodes are used.
• Both cluster nodes are the same model with identical hardware specs.
• Both units have a factory default configuration and there are no existing settings on these units.

Determine the Synchronization Interface

One interface on each node will be dedicated for synchronization tasks. This is typically referred to as the “Sync” interface, and it is used for configuration synchronization and pfsync state synchronization. Any available interface may be used. It isn’t necessary for it to be a high speed port, but it is necessary to choose the same port on both nodes.

Interface Assignments

Interfaces must be assigned in the same order on all nodes exactly. If the interfaces are not aligned, configuration synchronization and other tasks will not behave correctly. The default configuration has all interfaces assigned by default, as seen in the IO Ports section of the unit’s product manual, which makes a good starting point for this guide. If any adjustments have been made to the interface assignments, they must be replicated identically on both nodes.

IP Address Requirements

A High Availability cluster needs three IP addresses in each subnet along with a separate unused subnet for the Sync interface. For WANs, this means that a /29 subnet or larger is required for an optimal configuration. One IP address is used by each node, plus a shared CARP VIP address for failover. The synchronization interface only requires one IP address per node.

The IP addresses used in this guide are shown in the following tables, substitute the real IP addresses as needed.

Determine CARP VHID Availability

CARP can interfere with VRRP, HSRP, or other systems using CARP if conflicting identifiers are used. In order to ensure that a segment is clear of conflicting traffic, perform a packet capture on each interface looking for CARP/VRRP traffic. A given VHID must be unique on each layer 2, so each interface must be checked separately. The same VHID may be used on different segments so long as they are separate broadcast domains.

If any CARP or VRRP traffic is shown, note the VHID/VRID and avoid using that identifier when configuring the CARP VIP VHIDs later.

This guide assumes there is no other potentially conflicting traffic present.

Setup Requirements

Using the Setup Wizard, or manually afterward, configure each firewall with a unique hostname and non-conflicting static IP addresses.

For example, one node could be “firewall-a.example.com” and the other “firewall- b.example.com”, or a more personalized pair of names. Avoid naming the nodes “master” and “backup” since those are states and not roles, instead they could be named “primary” and “secondary”.

For IP addresses, the factory default LAN address is 192.168.1.1. In a High Availability environment, that address would be a CARP VIP instead. Using that subnet, move each node to its own address there, such as 192.168.1.2 for the primary and 192.168.1.3 for the secondary. This layout is shown in LAN IP Address Assignments

Once each node has a unique LAN IP address, then both nodes may be plugged into the same LAN switch.

Both nodes must have the GUI running on the same port and protocol. This guide assumes both use HTTPS on port 443.

The admin account cannot be disabled and both nodes must have the same admin account password.

Both nodes must have static IP addresses in the same subnet and have a proper gateway configured on the WAN interface settings.

Both nodes must have DNS configured properly under System > General Setup.

Visit Services > DNS Resolver. Review the settings and even if nothing has been changed, click Save once to ensure the default values are respected.

Switch / Layer 2 Configuration