Related Topics
Before You Begin
Before you configure a FireCluster, you must sure you have the necessary components, configure the external interface on your Fireboxes, configure your network routers and switches, and select the IP addresses for the FireCluster interfaces.
Verify Basic Components
Make sure that you have these items:
- Two activated Fireboxes with the same model number
- The same version of Fireware installed on each Firebox
- The same interface modules installed on each Firebox (M4600 and M5600 only)
- The feature key for each Firebox, saved in a local file; for more information, see Get a Firebox Feature Key
- One crossover cable (red) for each cluster interface (If you configure a backup cluster interface, you must use two crossover cables.)
- One network switch for each enabled trusted, optional, custom, or external interface
- Ethernet cables to connect the interfaces of both devices to the network switches
For information about feature key requirements for FireCluster, see About Feature Keys and FireCluster.
For information about supported models, see Supported Models for FireCluster.
If the Fireboxes you want to cluster have modular interfaces or a model upgrade, see these topics for specific requirements:
Configure the External Interface
Before you can configure a FireCluster, you must make sure that the external interface configuration is compatible with the type of FireCluster you want to use.
- Active/active FireCluster — Each external interface must have a static IP address.
- Active/passive FireCluster — Each external interface must have a static IP address, or be configured for PPPoE. In Fireware v11.12 or higher, the external interface can be configured for DHCP.
PPPoE for an active/passive FireCluster is supported in Fireware v11.9 and higher.
For more information about how to configure the external interface, see Configure an External Interface.
Configure Network Routers and Switches
In an active/active FireCluster configuration, the network interfaces for the cluster use multicast MAC addresses. Before you enable an active/active FireCluster, make sure your network routers and other devices are configured to correctly route traffic to and from the multicast MAC addresses.
For more information, see Switch and Router Requirements for an Active/Active FireCluster.
This step is not necessary for an active/passive cluster because an active/passive cluster does not use multicast MAC addresses.
Select IP Addresses for Cluster Interfaces
We recommend you make a table with the network addresses you plan to use for the cluster interfaces and interface for management IP address. To avoid conflict with routable IP addresses, we recommend you allocate a dedicated private subnet to each cluster interface, or use link-local IP addresses that begin with 169.254. If you use link-local IP addresses, you might find it useful to define your cluster interface IP addresses like this:
169.254.<interface number>.<member number>/24
The FireCluster setup wizard asks you to configure these settings individually for each cluster member. If you plan the interfaces and IP addresses in advance, it is easier to configure these interfaces with the wizard. For example, something like this:
| Interface # and IP addresses for a FireCluster | |||
|---|---|---|---|
| Interface # | IP address for Member 1 | IP address for Member 2 | |
| Primary cluster interface | 5 | 169.254.5.1/24 | 169.254.5.2/24 |
| Backup cluster interface | 6 | 169.254.6.1/24 | 169.254.6.2/24 |
| Management interface | 1 | 10.0.10.100/24 | 10.0.10.102/24 |
Primary cluster interface
This is the interface that you dedicate to communication between the cluster members. This interface is not used for regular network traffic. If you have an interface configured as a dedicated VLAN interface, do not choose that interface as a dedicated cluster interface.
The primary interface IP addresses for both cluster members must be on the same subnet.
For a Firebox M5600 FireCluster, we recommend you select interface 32 as the primary cluster interface. For more information, see About FireCluster with Modular Interfaces.
Backup cluster interface (optional, but recommended)
This is a second interface that you dedicate for communication between the cluster members. The cluster members use the backup cluster interface to communicate if the primary cluster interface is not available. For redundancy, we recommend you use two cluster interfaces.
The backup interface IP addresses for both cluster members must be on the same subnet.
Do not set the Primary or Backup cluster IP address to the default IP address of any interface on the device. The default interface IP addresses are in the range 10.0.0.1–10.0.26.1. The Primary and Backup cluster IP addresses must not be used for anything else on your network, such as virtual IP addresses for Mobile VPN or the IP addresses used by remote branch office networks.
Interface for management IP address
This is an interface that you use to make a direct connection to a cluster device from any WatchGuard management application. It must be on the same subnet as the server the Firebox sends log messages to.
The management IP address for each cluster member must be an unused IP address on the same subnet as the address assigned to the interface configured as the Interface for management IP address.
If the Interface for management IP address has IPv6 enabled, you can also configure an IPv6 management IP address for each cluster member.
For more information, see About FireCluster Management IP Addresses.
For wireless devices, the primary cluster interface, backup cluster interface, and interface for management IP address cannot be an interface that is bridged to a wireless network.
For more information, see About FireCluster on Wireless Models.