Before you connect the FireCluster hardware, review the list of FireCluster requirements and the switch and router requirements.
To connect two Fireboxes in a FireCluster configuration that have modular network interfaces, go to About FireCluster with Modular Interfaces.
To connect two Fireboxes in a FireCluster configuration:
- Use an Ethernet cable to connect the primary cluster interface on one Firebox to the primary cluster interface on the other Firebox. Tip!
- If you plan to enable a backup cluster interface, use a second Ethernet cable to connect the backup cluster interfaces. If you have a network interface available, we recommend that you connect and configure a backup cluster interface for redundancy.
- Connect the external interface of each Firebox to a network switch or VLAN. If you use Multi-WAN, connect the second external interface of each Firebox to another network switch.
- Connect the trusted interface of each device to an internal network switch or VLAN.
- For each Firebox, connect the other trusted or optional network interfaces to the internal network switch for that Firebox.
We recommend that you do not use a switch between each member for the cluster interfaces. If you do use a switch between cluster interfaces, the cluster interfaces must be logically separated from each other on different VLANs.
You must connect each pair of network interfaces to a separate local network or VLAN.
If any interface on the Firebox configuration uses the IP address 10.0.1.1, do not connect the trusted and optional network interfaces of the second device to the switches until after the cluster has been formed. This avoids an IP address conflict when you start the second device with factory-default settings. The devices use the cluster interfaces to form the cluster. After the you save the configuration to the cluster master, and the cluster is active, connect each of the trusted and optional interfaces of the second device to the appropriate switches.
This diagram shows connections for a simple FireCluster configuration.
In this example, the FireCluster has one external and one trusted interface connected to network switches. The primary cluster interfaces are connected by an Ethernet cable.
After you connect the FireCluster hardware, you are ready to configure the FireCluster in Policy Manager. You can do this two ways:
In some cases it might be necessary to use an alternate method of cluster formation when you need to bypass the default FireCluster discovery process.
- If you want to use the network module interface of a Firebox instead of the built-in network interfaces to form the cluster.
- To troubleshoot cluster members that do not join the cluster with the traditional discovery method because of network or other issues.
With this method, you save the FireCluster configuration separately to each Firebox:
- Enable FireCluster on a single Firebox that is already installed on your network.
- Use Policy Manager to save the same cluster configuration to the second cluster member.
- After FireCluster is separately enabled on both members, you can connect the second Firebox to the first Firebox and to the network.
To configure a FireCluster with the alternate method:
- Use Policy Manager to enable and configure FireCluster on the first Firebox. To configure the FireCluster you must have the feature key for both cluster members. For more information, see steps 1 through 4 in Quick Start — Set Up a FireCluster.
- In Policy Manager, save the configuration to the IP address of the first Firebox.
- Connect your management computer to the second Firebox.
- In Policy Manager, save the configuration to the IP address of the second Firebox.
When you save the configuration to the second Firebox, Policy Manager displays a warning if the IP address you specify does not exist in the configuration file. Because you want to replace the existing configuration, click Yes to confirm that you want to save the file.
- Connect the cluster members to each other and to the network switches. For more information, see Connect the FireCluster Hardware.
The cluster forms automatically.
To verify that the cluster has formed, connect to a configured interface IP address for the cluster in WatchGuard System Manager. For more information, see Monitor and Control FireCluster Members. If the cluster does not form, recheck the connections, particularly the connection between the primary cluster interfaces on each member.