Chapter 21: High Availability and Clustering

Introduction

The key to a Single Entry Point (SEP) VPN is to use high-availability (HA) and clustering solutions. Of course, if you choose not to use the VPN features of FireWall-1, you can still use the HA and clustering features described in this chapter. Check Point, Nokia, and other third-party companies offer many methods for deploying HA solutions. Here we focus on the Check Point ClusterXL product, review the new Nokia IP clustering and VRRP solutions, and discuss the performance of these solutions. We also spend some time describing how each solution actually works and what the "life of a connection" is like through each clustering solution.

When you set up a cluster, one of the first things you want to do is test that it is working as expected. In this chapter, we cover a quick list of tests that you can do on each cluster to make sure you get the right responses. We also cover some of the command-line tools you can use to check the status of each node in the cluster.