Netgate SG-1000 microFirewall

Author Topic: Firewall layer 2 cluster configuration  (Read 1167 times)

0 Members and 1 Guest are viewing this topic.

Offline praveen.varshney

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Firewall layer 2 cluster configuration
« on: September 27, 2016, 01:21:33 am »
Can we have firewall cluster at layer 2??    Suppose we have two firewall machines. One firewall machine have LAN, WAN , OPT1(having some VLAN) ,OPT2 (having some VLAN) and Bridge(OPT1 and OPT2). And there is another firewall machine that doesnt have any LAyer 2 configuration. Now i want all config and states configuration on second firewall and automatic switchover from one firewall to another without using CARP as IP wont be required for Layer 2. Can anyone help me on this if it is feasible to configure firewall cluster on layer 2 or nor not. If it is can anyone explain me the procedure for it .???

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21571
  • Karma: +1471/-26
    • View Profile
Re: Firewall layer 2 cluster configuration
« Reply #1 on: October 05, 2016, 08:45:27 am »
Performing HA or failover at layer 2 creates a layer 2 loop. You have to rely on STP or similar protocols to stop the loop and then switch the ports if the preferred path fails.

It's a mess, an accident waiting to happen, and difficult to get right because a lot of it depends on your switches and not the firewall at all.

You can certainly try it if you like, but it's not something we like to encourage. :-)
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!