Connect the Hardware for a Cloud-Managed FireCluster

Applies To: Cloud-managed Fireboxes

This document applies to Fireboxes you manage in WatchGuard Cloud. For information that applies to Fireboxes managed in Fireware Web UI or WatchGuard System Manager, go to:

Overview

This diagram shows connections for a simple cloud-managed FireCluster configuration.

Diagram of a simple FireCluster configuration

In this example, the FireCluster has one external and one trusted interface connected to network switches. The cluster interfaces are connected by an Ethernet cable. Make sure your Ethernet cables are a minimum 1m (3ft) or longer.

Connect a FireCluster

To connect two Fireboxes in a cloud-managed FireCluster configuration:

  1. Use an Ethernet cable to connect the cluster interface on one Firebox to the cluster interface on the other Firebox. You can use a straight or crossover cable. Make sure your Ethernet cables are a minimum 1m (3ft) or longer.

    We strongly recommend you use direct connections for the cluster interfaces between each cluster member. Network equipment between the cluster interfaces such as switches introduce additional points of failure and latency. If cluster members are separated by a switch, the cluster interfaces must be on the same broadcast domain.

  1. (Optional) Use a second Ethernet cable to connect the backup cluster interfaces.

    If you use both primary and backup cluster interfaces, the interfaces must be on different subnets. We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster members, the cluster interfaces must be logically separated from each other on different VLANs. We recommend that you configure a backup cluster interface if you separate the cluster interfaces with a switch.

  1. Connect the external interface of each Firebox to a network switch or VLAN. If you use Multi-WAN, connect the second external interface of each Firebox to another network switch.
  2. Connect the trusted interface of each device to an internal network switch or VLAN.
  3. For each Firebox, connect the other trusted or optional network interfaces to the internal network switch for that Firebox.

You must connect each pair of network interfaces to a separate local network or VLAN.

WARNING: If any interface on the Firebox configuration uses the IP address 10.0.1.1, do not connect the trusted and optional network interfaces of the second device to the switches until after the cluster has been formed. This avoids an IP address conflict when you start the second device with factory-default settings. The devices use the cluster interfaces to form the cluster. After the you save the configuration to the cluster master, and the cluster is active, connect each of the trusted and optional interfaces of the second device to the appropriate switches.

After you connect the FireCluster hardware, you are ready to configure the FireCluster in WatchGuard Cloud. For more information, go to Add a Cloud-Managed FireCluster

Related Topics

About FireCluster in WatchGuard Cloud

Before You Configure a Cloud-Managed FireCluster in WatchGuard Cloud

Configure an RMA Replacement for a Cloud-Managed FireCluster Member