Prepare interfaces and IP addresses for converting a Single Engine to a Engine Cluster
Engine Clusters have different IP addressing requirements than Single Engines. You must change the IP address that is used for a particular role if the new interface type is not compatible with that role.
Engine Clusters must have two types of IP addresses:
- NDI (Node Dedicated IP Address) — An IP address that is used for traffic to or from an individual node in a cluster. Each node in the cluster has a specific IP address that is used as the NDI.
- CVI (Cluster Virtual IP Address) — An IP address that is used to handle traffic routed through the cluster for inspection. All nodes in a cluster share this IP address. Allows other devices to communicate with the Engine Cluster as a single entity. If other network devices, such as a default gateway or VPN endpoint, select the engine’s IP address, converting the IP address to a CVI allows those external configurations to remain the same.
Role | Type Required | Notes |
---|---|---|
Control interface (Management connections) | NDI | Each node requires its own NDI address. Often, the same IP address on a Single Engine is used for both the engine’s own communications and the
traffic that the engine processes. In these cases, you can convert the IP address that processes the traffic to a CVI. With the conversion, you can avoid reconfiguring
external equipment and you can add new NDI addresses for the nodes. Make sure that enough IP addresses are available in the network, especially if the Single Engine is managed remotely. |
DHCP relay | CVI | Configured in the physical interface properties. |
DHCP relay for VPN clients | NDI | Configured in the VPN settings in the Engine Editor. |
Heartbeat interface | NDI | Heartbeat and state synchronization communications between clustered engines. We recommend using a dedicated interface for the heartbeat, as reliable transmissions are critical to the operation of the cluster. If the heartbeat traffic passes through a switch, make sure that the switch does not throttle or block multicast traffic between the clustered engines. |
Routing | CVI | Traffic that is sent to an NDI address is not routed to any other destinations. Surrounding network devices that use the engine as a default gateway must use a CVI address. If the internal DHCP server is used and configured to assign the engine as the default gateway for clients, the default gateway IP address must be a CVI. (Configure the CVI in the physical interface properties.) |
VPN endpoints | CVI | Configured in the VPN settings in the Engine Editor. |
For more details about the product and how to configure features, click Help or press F1.