Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 29 subscribers
  • Views 8199 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG Clustering & Redundancy Limitations

Rockfish

Hi all,

Regarding the clustering/HA features of XG. The best practice advice seems to be that the clustering is only supported within a rack - e.g. two XGs, with a CAT6 cable directly connecting one HA port to another. Clustering two XG firewalls across two geographic sites is - correct me if i'm wrong - not supported. Even if connected by high-bandwidth, low latency links.

Therefore to achieve redundancy, you need to run two separate firewalls, two separate sets of firewall rules, public IP addresses, etc.

This seems like quite a limitation - is cross-site clustering on the road map for a future release? How do other XG users correctly achieve redundancy with two data centers?

Thanks



This thread was automatically locked due to age.
Parents
  • 0

    If I had to build a HA-setup with geo-redundant datacenters I use a common practise to avoid the split brain:

    Also other systems have the same problem if the interconnect DC1<->DC2 is broken. But here the problems are starting, wrong planing of the interconnect ;).

     

    So you've to tell one site, in case of a broken interconnect, which is active and which site has to go into standby.

    Simple solution -> shutdown the network ports with a simple track script on the Cisco switch.

     

    So the second XG will state to invalid and is not getting active.

Reply
  • 0

    If I had to build a HA-setup with geo-redundant datacenters I use a common practise to avoid the split brain:

    Also other systems have the same problem if the interconnect DC1<->DC2 is broken. But here the problems are starting, wrong planing of the interconnect ;).

     

    So you've to tell one site, in case of a broken interconnect, which is active and which site has to go into standby.

    Simple solution -> shutdown the network ports with a simple track script on the Cisco switch.

     

    So the second XG will state to invalid and is not getting active.

Children
No Data