HP VPN Firewall Appliances High Availability Configuration Guide

i
Contents
High availability overview ··········································································································································· 1
Availability requirements ·················································································································································· 1
Availability evaluation ······················································································································································ 1
High availability technologies ········································································································································· 2
Fault detection technologies ···································································································································· 2
Protection switchover technologies ························································································································· 3
Configuring VRRP ························································································································································· 4
VRRP overview ··································································································································································· 4
VRRP standard mode ························································································································································ 5
Configuring IPv4 VRRP in the Web interface ·············································································································· 10
Recommended configuration procedure ············································································································· 10
Creating a VRRP group ········································································································································· 11
Configuring a VRRP group ··································································································································· 12
Configuring IPv4 VRRP at the CLI ································································································································· 16
IPv4 VRRP configuration task list ·························································································································· 16
Specifying the type of MAC addresses mapped to virtual IP addresses ························································· 16
Creating a VRRP group and assigning virtual IP address ················································································· 17
Configuring router priority, preemptive mode and tracking function ······························································ 18
Configuring VRRP packet attributes ····················································································································· 19
Enabling the trap function for VRRP····················································································································· 20
Displaying and maintaining VRRP for IPv4 ········································································································· 20
Configuring IPv6 VRRP at the CLI ································································································································· 21
VRRP for IPv6 configuration task list ···················································································································· 21
Specifying the type of MAC addresses mapped to virtual IPv6 addresses ···················································· 21
Creating a VRRP group and configuring a virtual IPv6 address ······································································ 22
Configuring router priority, preemptive mode and tracking function ······························································ 23
Configuring VRRP packet attributes ····················································································································· 24
Displaying and maintaining VRRP for IPv6 ········································································································· 24
IPv4 VRRP configuration examples ······························································································································· 25
Single VRRP group configuration example (in the Web interface) ·································································· 25
Single VRRP group configuration example (at the CLI) ····················································································· 28
VRRP interface tracking configuration example ································································································· 31
Multiple VRRP groups configuration example (in the Web interface) ····························································· 34
Multiple VRRP groups configuration example (at the CLI) ················································································· 37
IPv6 VRRP configuration examples ······························································································································· 40
Single VRRP group configuration example ········································································································· 40
VRRP interface tracking configuration example ································································································· 43
Multiple VRRP groups configuration example ···································································································· 46
Troubleshooting VRRP ···················································································································································· 49
The screen frequently displays error prompts ····································································································· 49
Multiple masters appear in a VRRP group ·········································································································· 49
Frequent VRRP state transition ······························································································································ 50
Configuring stateful failover ······································································································································ 51
Stateful failover overview ·············································································································································· 51
Operating procedure ············································································································································ 51
Service backup ······················································································································································ 52
Configuration synchronization ····························································································································· 52
Stateful failover states ··········································································································································· 52