O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

18.11. Configure NAT in an Active-Active Cluster

Problem

You need to configure NAT with NSRP in active-active mode.

Solution

Set up a standard NSRP cluster:

	FIREWALL-A-> set nsrp cluster id 1
	FIREWALL-A(M)-> set nsrp cluster name FWCLUSTER
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 priority

	FIREWALL-B-> set nsrp cluster id 1
	FIREWALL-B(B)-> set nsrp vsd-group id 1 priority 10
	FWCLUSTER:FIREWALL-B(B)-> save
	FWCLUSTER:FIREWALL-B(B)-> exec nsrp sync global-config saved
	FWCLUSTER:FIREWALL-B(B)->reset

Once FIREWALL-B comes back online, continue the configuration by enabling RTO synchronization, configuring timers, and setting up monitoring parameters:

	FWCLUSTER:FIREWALL-A(M)-> set nsrp rto-mirror sync
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group hb-interval 200
	FWCLUSTER:FIREWALL-A(M)-> set nsrp data-forwarding
	FWCLUSTER:FIREWALL-A(M)-> set nsrp monitor interface ethernet0/1
	FWCLUSTER:FIREWALL-A(M)-> set nsrp monitor interface ethernet0/3
	FWCLUSTER:FIREWALL-B(M)-> set nsrp monitor interface ethernet0/1
	FWCLUSTER:FIREWALL-B(M)->set nsrp monitor interface ethernet0/3

Finally, ensure that the two devices remain active when possible by configuring preempt for the appropriate groups, and setting master-always-exist:

	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 preempt
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group id 0 preempt hold-down 90
	FWCLUSTER:FIREWALL-A(M)-> set nsrp vsd-group master-always-exist
	FWCLUSTER:FIREWALL-B(M)-> set nsrp vsd-group id 1 preempt FWCLUSTER:FIREWALL-B(M)-> ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required