Technical data

ServerIron ADX Firewall Load Balancing Guide 177
53-1002436-01
Configuring failover tolerance in IronClad configurations
A
DRAFT: BROCADE CONFIDENTIAL
Configuring failover tolerance in IronClad configurations
By default, failover from the active ServerIron ADX to the standby ServerIron ADX in an IronClad
configuration occurs if a path link on the active ServerIron ADX becomes unavailable. If all the path
links are stable, failover is an uncommon event. However, an unreliable link can cause frequent
failover. For example, if a link on a firewall flaps (goes up and down) frequently, the flapping can
cause frequent, unnecessary failovers.
You can reduce the frequency of such failovers by specifying a path link tolerance for firewall paths
and for router paths. The tolerance specifies the minimum number of such paths that must be
good in order for the active ServerIron ADX to remain active. Only if the number of paths is less than
the configured minimum and less than the number of available paths on the other ServerIron ADX
does failover occur. If the number of paths remains equal on each ServerIron ADX, even if some
paths are unavailable on each ServerIron ADX, failover does not occur.
The default failover tolerance for firewall paths is one half the configured firewall paths. The default
tolerance for router ports is one half the configured router ports.
To change the minimum number of paths required on a ServerIron ADX, use the following method.
NOTE
The minimum number of required paths must match on each ServerIron ADX in an active-standby
pair. For example, if you specify one router path and three firewall paths as the minimum on the
active ServerIron ADX, you must configure the same minimums on the standby ServerIron ADX.
To specify the minimum number of paths required on a ServerIron ADX, enter the following
commands.
ServerIronADX(config)# server fw-group 2
ServerIronADX(config-fw-2)# prefer-router-cnt 1
ServerIronADX(config-fw-2)# prefer-cnt 3
This example specifies that a minimum of one router path and three firewall paths must be
available for the ServerIron ADX to remain active. Thus, if the ServerIron ADX has four firewall
paths, one path can be unavailable and the ServerIron ADX will remain the active ServerIron ADX.
Syntax: [no] prefer-router-cnt <num>
Syntax: [no] prefer-cnt <num>
For each command, the <num> parameter specifies the minimum number of paths required.