Amer Networks E5Web GUI - Manual (Page 96)

reconfigure takes place and the slave will take over when it detects this inactivity. If
reconfiguration with failover is desirable it is better to select the option 3. Failover and
reconfigure since this performs the failover first and is nearly instantaneous with almost no
traffic interruption. Reconfiguration first is slower and results in some traffic interruption.
To preserve all tunnels in a VPN scenario, it is best to choose the 2. Failover option since a
reconfiguration can cause some tunnels to be lost.
Link Monitoring with HA Clusters
The most common use for link monitoring is in the HA cluster scenario described above. It is
important that the master and slave do not duplicate the same condition that triggered the link
monitor. For example, if a particular router connected to the master Clavister Security Gateway
was being "pinged" by link monitoring, the slave should not also be connected to that router. If it
is, the continued triggering of a reconfiguration by the link monitor will then cause the slave to
failover back to the master, which will then failover back to the slave again and so on.
If it is important to not allow a failover during reconfiguration of the active unit in an HA cluster
then the advanced setting Reconf Failover Time should be set to a value which is neither too
low or too high.
Reconf Failover Time controls how long the inactive unit will wait for the active unit to
reconfigure before taking over. Setting this value too low will mean the inactive unit does not
wait long enough. Setting the value too high could mean significant downtime if the active unit
fails during reconfiguration and the inactive unit needs to take over.
More information on clusters can be found in Chapter 11, High Availability.
IPsec Tunnels and HA Clusters
If the triggered link monitor action is a failover or failover and reconfigure, any IPsec tunnels are
automatically closed and the tunnel SAs deleted at both ends. After the failover takes place the
following will occur:
• If the IPsec tunnel was a LAN-to-LAN tunnel, it will be automatically re-established provided
traffic flows within the keepalive time specified for the tunnel.
• Any IPsec tunnels from external clients will be lost and will not be re-established
automatically. The client must initiate a new connection.
Link Monitor Object Properties
A Link Monitor configuration object has the following properties:
Action Specifies which of the 3 actions described above cOS Core should
take.
Addresses This property specifies the IP address of one or more hosts to
monitor. For multiple hosts, if half (50%) or more respond then
there is assumed to be no problem. If less than half of multiple
hosts do not respond, cOS Core assumes that there is a link
problem. With a single host, it either responds or it doesn't so the
50% rule is not relevant.
A host is not used in this 50% calculation until cOS Core has been
able to reach it at least once since the last cOS Core
Chapter 2: Management and Maintenance
96