TMS zl Module Planning and Implementation Guide 2009-08
Table Of Contents
- Contents
- Glossary of Acronyms and Abbreviations
- 1.0 Purpose
- 2.0 Intended Audience
- 3.0 Objectives
- 4.0 Prerequisites
- 5.0 Skills
- 6.0 The HP ProCurve Threat Management Services zl Module
- 7.0 Common TMS Security Control Points
- 8.0 Deployment Considerations
- 9.0 Installation and Preparation of the TMS zl Module
- 10.0 Configuration of the TMS zl Module
- 11.0 Using multiple HP ProCurve Threat Management Services zl Modules
- Appendix A – Additional References
- Appendix B – Sample Company Information Assets Spreadsheet
- Sample “Information Assets” tab (See Embedded “Company Information Assets” Microsoft Excel 2003 spreadsheet)
- “Server Network Details” tab (See Embedded “Company Information Assets” Microsoft Excel 2003 spreadsheet)
- “TMS Zones” tab (See Embedded “Company Information Assets” Microsoft Excel 2003 spreadsheet)
- “Firewall Rules” tab (See Embedded “Company Information Assets” Microsoft Excel 2003 spreadsheet)
- /Sample “Company Information Assets” Microsoft Excel 2003 spreadsheet
- Appendix C – Information Gathering Tools
- Appendix D - Updating Switch Software
- Appendix E – Emergency Recovery Process
Page 138
If the cluster members are in different host switches, you must ensure that the same
VLANs are configured on both host switches and that there are redundant Layer 2
connections between the host switches.
“Master” vs “Participant” Considerations - When configuring the HA cluster, one TMS zl
Module is configured first and it becomes the “Master” for the cluster. By design, when
additional modules are configured as part of the cluster, they become a “Participant” and
the configuration of the master module is copied over
The order in which you configure and reboot the members of an HA cluster is extremely
important. The cluster member that comes online first will be the master, and the module
that comes online second will be the participant, regardless of the priority that you have
specified. Be sure to identify which module you want to be designated as master and that
it is booted prior to bringing the other module online.
any configuration on the
participant module. This presents 3 important items to note:
When performing the initial HA cluster configuration, make sure that your designated
master is the only
When adding the participant module to the HA cluster, be sure there are no important
configuration settings on the target participant module or that a backup of the
configuration is made before the HA Cluster configuration process begins. By design,
the master will overwrite the configuration on the participant module so any existing
configuration on the participant module will be permanently lost.
module selected for configuration. Then, once the configuration is
completed and the module booted, add the participant module for configuration. You
must take care when configuring and rebooting cluster members to avoid losing all of
your settings and to avoid an unexpected module from becoming the master for the HA
Cluster.
Linking Inter-Chassis Clusters - An inter-chassis cluster consists of cluster members that
are physically located in different switch chassis. When connecting the two chassis,
follow these guidelines:
• There should be at least one Layer 2 link and preferably redundant links,
between the two switch chassis. If there is only one link between the host
switches of an inter-chassis cluster, and that link fails, the cluster
participant cannot receive the “heartbeat” messages from the master.
• If you use redundant links, enable the switches’ STP (Spanning-Tree
Protocol) or RSTP (Rapid Spanning-Tree Protocol) functionality to
prevent a loop.
• The switch ports that connect the host switches should be tagged
members of the HA VLAN.
• All TMS VLANs must be configured on both host switches.
• It is highly recommended that other network devices not be placed
between the switch chassis that contain the cluster members to reduce the
risk of link failure.