Hey all, it's Jay from Sophos Support here.
We'll be covering the configuration part of High Availability in this video.
If you haven't already checked out our first video covering what type of configuration
you should use, such as Active-Active or Active-Passive, prerequisites and general workflow, we've
put it in the video description and highly recommend that you check that out first.
Otherwise, let's cover the different ways that you can setup HA.
There are 2 ways that you can setup HA in your environment.
You can use QuickHA which lets you setup your firewalls with the least amount of configuration
steps.
The other option is Interactive Mode.
Interactive Mode is a legacy mode which allows you to configure all of the HA parameters
manually.
We'll start off with QuickHA, since it's the simplest.
To setup QuickHA, you'll first have to connect both Firewalls together using a network cable
plugged into the dedicated HA port on both units.
We'll then log into the web admin console of the primary Firewall and navigate to System
Services > High Availability.
Since this is the primary firewall, choose if you'll be using Active-Passive or Active-Active
for the Device Role.
After that select Quick HA and enter a passphrase.
One thing to note is that a passphrase is automatically generated.
However, you can override this and use your own if needed.
The passphrase is used only once to generate the SSH keys that will be used to encrypt
communication over the HA link.
Once these keys are generated the passphrase is deleted from the system.
Now we'll select the dedicated HA link.
When using automatic selection the system will select the first unbound interface, or
if this is not available it will use the first DMZ port, as the dedicated HA interface.
By default, it is going to automatically select the interface but we can also manually select
it.
The interface that is selected will also be renamed QuickHA Mode interface.
Please note though, if automatic selection doesn't find any unbound interface and selects
the DMZ port, this will override any configuration already done on that port.
Now, you can click on Initiate HA.
Next, we’ll login to the web admin console of the Auxiliary Firewall and navigate to
System Services > High Availability.
Choose Auxiliary for the device role.
Select Quick HA and enter the same passphrase used on the primary Firewall.
Now you can go ahead and click Initiate HA
And now, our configuration is complete.
It's that easy!
Before we get to configuring Interactive mode, we'll just recap on the major prerequisites
from the previous video.
The dedicated HA port of the firewall must be in the DMZ and also needs to have the SSH
admin service enabled.
The IP addresses on the two devices need to be in the same subnet.
If you are using Active-Passive, only one license is required
but it must be applied to the primary device.
Lastly, if you are using Active-Active, the auxiliary device needs to be configured before
the primary device.
If you still need more information on the prerequisites, you can check out the previous
video or read the documentation in the description.
Now, let's start by configuring the Auxiliary device.
In the web admin console, we'll navigate to System Services > High Availability.
Here, the device role will be set to Auxiliary.
Make sure the HA configuration mode is set to Interactive Mode.
Now, enter and confirm the passphrase that will be used to generate the private/public
key to secure the communications between the devices.
Select the port that will be used for the dedicated HA link.
Only ports that are in the DMZ will be selectable here.
The same port must be used on both devices.
The ports can be connected directly with a crossover cable or via a switch.
The Auxiliary device is now setup and we'll switch over to the Primary device.
Login to the web admin of the Primary device and go to System Services > High Availability.
Here, select the device role based on if you are using Active-Active or Active-Passive.
Now, make sure the HA configuration mode is set to Interactive mode.
For the Cluster ID field, by default it is going to set the cluster ID to zero but if
you have multiple HA pairs in network, then you can configure a different cluster ID for
different HA pair which will have a different set of virtual MAC addresses.
In the Passphrase field, enter and confirm the passphrase that will be used to generate
the private/public keys to secure the communications between the devices.
This will be the same key that was set on the Auxiliary device
For the Dedicated HA link and IPv4 address, select the port to use for the dedicated HA
link.
This must be the same port as on the auxiliary device.
Also note that only ports in a zone type of DMZ will be listed here.
For Select Ports to be monitored, this will be a list of ports that will be monitored.
If the connection to any of these ports fail, the device will leave the cluster and the
cluster will failover to the auxiliary device.
This feature is not supported in virtual security devices.
In the Peer administration setting box, enter the IP address of the auxiliary device.
This is the IP address of the port for the dedicated HA link.
You can also configure multiple peer IP's here.
You will also want to select the port and specify an IP address for the administration
console.
The Keepalive request interval specifies the time in milliseconds for the heartbeat packet
exchange by HA peers to confirm that the cluster is functioning.
Keepalive attempts is the number of attempts that should be made before determining a device
has failed.
The Use host or hypervisor-assigned MAC address only needs to be configured if you are deploying
the firewall in a virtual environment such as a hypervisor like Vmware or Hyper-V. You'll
need this enabled as it requires MAC ACL’s to be allowed on Hypervisor and sometimes
Users don’t have admin rights over them.
For the virtual switch, you'll also want to make sure that the port connected to the device
is set to promiscuous mode.
The last field is Fail back to primary device after it recovers.
If this option is enabled, the Primary device will resume being the Primary after recovery
and the Auxiliary will return to being the Auxiliary device instead of trading roles.
We've mentioned this in our previous video but we'll be going over it again.
There a few things that can trigger a failover to occur on the firewalls.
One of the most common instances of this is a monitored port going down.
The next would be a device failure.
Reasons for that could be a power loss, hardware or software failure and other things.
You'll find an article in the video description going over all the things that can trigger
a failover.
And just like that, HA should be up and running!
If you still want more information on HA, we've linked some articles in the video description
that will help you out.
Gives us a thumbs up if you found this helpful.
Find more helpful videos like this on techvids.sophos.com and connect with us in the Sophos Community
and on social media.
This is Jay, signing off.