Configuring warm spare questions

[badufamily]

Last week in a spare bit of time I attempted to bring up a 'warm spare' of our untangle firewall.

my goal is to have a box ( U#2) around which I can simply tell the family to plug in the appropriate patch cables should the current firewall ( U#1) go down. They are good with following instructions and I am good with a label machine.

( we have a second home where this happened, which is what prompted this work. The second home's untangle had run out of disk space....doh )

To make the procedure simple what should I do WRT the IP address of U#2, the backup on the home network? As you may suspect the gateway address handed out to the various DHCP devices all look to the specified IP for routing.

There is advice in this forum to keep the warm spare on the network to receive updates from Untangle/Arista.

So I configured the fresh install, gave it a safe internal IP, and fired it up on the LAN. It phoned home to Arista (surprise) where I registered the UID ( ok, and I understand I could swap licences as needed between U#1 & U#2, so I just followed through) , and bam, everything went down. Rather, I had no internet, everything was running but the old firewall was wacked out. Nothing routed out until I unplugged the new device.

q: is there some problem with 2 untangle instances with the same public IP?

q: should I take a backup from untangle #1, restore it on untangle Forum and then change the DHCP settings on U#2 such that the gateway address is U#2's IP? ( we have a lot of hardcoded TCP/IP configs on some of the hosts so that would be a bit of a half-valid approach )

I'm wondering if I ran into the configuration issue described in the Announcements thread.

TIA, good luck

[jcoffin]

Shared IP is not possible unless the setup is using VRRP (article below). In the case of using VRRP, you need N + 1 WAN IPs where N is the number of NGFW boxes. In the case of two NGFW, you need 3 IP address. One of each NGFW and a shared IP in the VRRP config.

https://wiki.edge.arista.com/index.php/Network_Configuration#VRRP

[gravenscroft]

q: is there some problem with 2 untangle instances with the same public IP?

The same problem as any two devices trying to use the same IP address: network conflicts. IP addressing is how an individual device is identified and routed to, so sharing the same IP between more than one device simultaneously will cause neither to work.

Another concern is a state called 'MAC locking' or 'MAC bonding'. A lot of ISP modems prefer to only communicate with a single piece of hardware, which is usually a switch or router between it and the remainder of the network. When the MAC address immediately downstream changes — as it does when you move cables to a second NG Firewall appliance — the ISP device will often refuse to complete negotiations and you end up with no internet access. In that instance, you usually need to reboot the ISP device (not the NG Firewall) so it detects the new MAC address. You'll probably have to do this every time the cables are moved from one unit to the other.

[badufamily]

Shared IP is not possible unless the setup is using VRRP (article below). In the case of using VRRP, you need N + 1 WAN IPs where N is the number of NGFW boxes. In the case of two NGFW, you need 3 IP address. One of each NGFW and a shared IP in the VRRP config.

https://wiki.edge.arista.com/index.p...iguration#VRRP

I think one can get away with 2 public IPs, from looking at the VRRP documentation under that link.

( however the example for Incoming connections is a bit confusing; is the common virtual IP a public IP? hmm the poor VPNs )

gee it might be easier to restore UT1's configuration onto UT2, bring down UT1 and start up UT2 and move cables. IF it works swap `em back out.
as long as that doesn't start the licensing clock. and yes then it's a cold spare.

[jcoffin]

I think one can get away with 2 public IPs, from looking at the VRRP documentation under that link.

You need at least 3 public IP addresses for VRRP. It's 1 for each NGFW and one addition for the VRRP virtual connection.