Quick Start — Set Up a FireCluster

Before you configure a FireCluster, make sure that you have these components:

• Two activated Fireboxes with the same model number
• The same version of Fireware installed on each Firebox.

If you have a brand new Firebox with factory-default settings, the version of Fireware that is installed on the Firebox is indicated on a sticker on the device.

• A feature key for each Firebox saved in a local file. For more information, go to Get a Firebox Feature Key.
• If the Fireboxes you want to cluster have modular interfaces, each Firebox must have the same interface modules installed. When the cluster is first formed, you must use a built-in interface to connect the two cluster members together. For more information, go to About FireCluster with Modular Interfaces.
• An Ethernet cable for each cluster interface. You can use a straight or crossover cable. (If you configure a backup cluster interface, you must use two cables.)
• One network switch for each enabled trusted, optional, custom, or external interface
• Ethernet cables to connect the interfaces of both devices to the network switches
• Make sure you understand how to connect the FireCluster members to each other and to the network, as described in Connect the FireCluster Hardware.

During the FireCluster configuration, do not connect your second Firebox to the cluster until you have configured the first Firebox that will be the cluster master.

Before you enable FireCluster, you configure one Firebox with the network and policy settings you want the cluster to use. Make sure the configuration settings meet the requirements for the FireCluster.

Requirements for an active/passive FireCluster:

• The Firebox must have at least one unused interface to use as the dedicated cluster interface.
• The Firebox must be configured in Mixed Routing Mode or Drop-In mode.
• All unused interfaces must be disabled.

There are a few configuration limitations for a FireCluster. Before you enable a FireCluster, go to Features Not Supported for a FireCluster.

Identify the cluster ID, interfaces, and IP addresses you will use in the FireCluster configuration.

• Cluster ID — For each FireCluster, you must configure a Cluster ID. The Cluster ID is used to generate virtual MAC (VMAC) addresses for the interfaces. If your network has more than one FireCluster, or has devices that use VRRP, make sure to select a Cluster ID that does not create a MAC address conflict. For more information, go to Active/Passive Cluster ID and the Virtual MAC Address.
• Cluster Interfaces — Identify which interfaces to use as primary and backup cluster interfaces. Each cluster interface is dedicated to communication between the cluster members. The backup cluster interface is optional. For each cluster interface, you configure an IP address on the same subnet for each cluster member. We recommend you assign IP addresses on a dedicated private subnet, or use link-local IP addresses. You might find it useful to define your cluster interfaces with link-local IP addresses like this: 169.254.<interface number>.<member number>/24
  The Primary and Backup cluster IP addresses must not be used for anything else on your network, such as virtual IP addresses for mobile VPN or the IP addresses used by remote branch office networks.

• Cluster Management Interfaces — Identify the interface you usually use to connect to the Firebox for management. Often this is a trusted interface. For each cluster member, you must configure a Management IP address for that interface. We recommend you select IP addresses on the same subnet as the interface IP address.

The cluster management interfaces are used by the cluster master to manage the cluster. Make sure the cluster management interface of both cluster members are connected to a common switch at all times. For more information, go to About FireCluster Management IP Addresses.

As an example, your planned FireCluster configuration settings could look like this:

For more information about these settings, go to Before You Configure a FireCluster.

Use the FireCluster Setup Wizard in Policy Manager to enable FireCluster and configure your planned settings on the first Firebox cluster member. This Firebox will become the cluster master. Make sure you have the feature key for both devices in a text file before you start the wizard.

1. In WatchGuard System Manager, connect to the configured Firebox that you want enable as the first FireCluster member.
2. Start Policy Manager.
3. Select FireCluster > Setup to start the FireCluster Setup Wizard.
4. Select the type of cluster you want to enable. The most common type of FireCluster is Active/Passive.
5. Select the Cluster ID.
   
6. Select the interfaces to use as the Primary and Backup cluster interfaces.
   These are the interfaces you directly connected with the Ethernet cable.
7. Select the Interface for Management IP address.
8. For each Firebox, configure these properties, that are unique to each member:
   • Feature Key — For the first member, the device feature key is included automatically. For the second device, paste the feature key text into the wizard.
   • Member Name — Identifies each device. The default names are Member1 and Member2
   • IP addresses — Use the cluster interface and management IP addresses you planned earlier.

10. Click Finish.
    The FireCluster Configuration dialog box appears.
    
11. In the Interface Settings section, review the list of monitored interfaces.
    We recommend that you monitor the link status of all enabled interfaces.

To automatically discover the second Firebox and add it to the cluster, do not save the configuration file until you start the second device in a factory-default state as described in the next steps.

For the cluster master to discover the second Firebox, you must reset the second Firebox to factory-default settings. The reset process resets the configuration and removes the feature key, but does not change the installed version of Fireware. For more information on how to reset your Firebox model, go to Reset a Firebox.

Connect the cluster interface of the cluster master Firebox to the cluster interface of the second Firebox of the FireCluster, as described in Connect the FireCluster Hardware.

In Policy Manager, select File > Save > To Firebox.

When you save the configuration with FireCluster enabled to the Firebox:

• The Firebox restarts and becomes the cluster master.
• The cluster master Firebox uses the cluster interface to automatically discover the second cluster member Firebox.
  
• When the cluster master Firebox discovers a connected device with factory-default settings, it verifies that the serial number matches the serial number in the FireCluster configuration, and then sends the cluster configuration to the second device.
• The second device then joins the cluster and synchronizes all cluster status with the cluster master. 

Connect to the cluster with Firebox System Manager or Fireware Web UI to verify that the cluster was formed and verify the status of cluster members.

• In Firebox System Manager, on the Front Panel tab, expand the cluster to see the status of cluster members.
• In Fireware Web UI, you can select System Status > FireCluster to view the cluster status.

For more information, go to Monitor and Control FireCluster Members.

Troubleshooting FireCluster

To troubleshoot cluster issues, go to Troubleshoot FireCluster

If the second Firebox is not automatically added to the cluster:

1. Make sure the primary cluster interfaces of both devices are connected.
2. Make sure the second Firebox is started with factory-default settings.
3. Select Tools > Cluster > Discover Member to manually trigger discovery of the second cluster member. For more information, go to Discover a Cluster Member.

Alternate FireCluster Formation Method

To more easily troubleshoot cluster members that do not join the cluster with the auto-discovery method because of network issues or a Fireware version mismatch, you can use the alternate cluster formation method to save the Firebox configuration to both devices.

The alternate method enables you to view error and log messages about reasons why the cluster was not formed. For more information, go to Alternate FireCluster Configuration.

This diagram shows connections for a FireCluster with one cluster interface, one trusted interface, and one external interface.

To connect your FireCluster hardware:

1. Use an Ethernet cable (straight or crossover) to connect the primary cluster interface on one Firebox to the primary cluster interface on the other Firebox.
2. If you plan to enable a backup cluster interface, use a second Ethernet cable to connect the backup cluster interfaces.
3. Connect the external interface of each Firebox to a network switch or VLAN. If you use Multi-WAN, connect the second external interface of each Firebox to another network switch.
4. Connect the trusted interface of each Firebox to an internal network switch or VLAN.
5. Connect each of the other enabled trusted or optional network interfaces on each Firebox to a network switch or VLAN.
   You must connect each pair of enabled interfaces to a separate switch.
6. Connect your computer to the switch on the trusted network.

WARNING: If interface 1 has the default IP address 10.0.1.1, do not connect interface 1 of the second device to the switch until after the cluster is successfully formed. This avoids a temporary IP address conflict when you start the second device with factory-default settings.