Create a Cluster

Form a cluster from one or more devices in the Firewall Management Center.

Before you begin

Some features are not compatible with clustering, so you should wait to perform configuration until after you enable clustering. Some features will block cluster creation if they are already configured. For example, do not configure any IP addresses on interfaces, or unsupported interface types such as BVIs.

Procedure

Step 1

Choose Devices > Device Management, and then choose Add > Cluster.

The Add Cluster Wizard appears.

Add Cluster Wizard
Add Cluster Wizard

Step 2

Specify a Cluster Name and an authentication Cluster Key for control traffic.

  • Cluster Name—An ASCII string from 1 to 38 characters.

  • Cluster Key—An ASCII string from 1 to 63 characters. The Cluster Key value is used to generate the encryption key. This encryption does not affect datapath traffic, including connection state update and forwarded packets, which are always sent in the clear.

Step 3

For the Control Node, set the following:

  • Node—Choose the device that you want to be the control node initially. When the Firewall Management Center forms the cluster, it will add this node to the cluster first so it will be the control node.

    Note

    If you see an Error (error icon) icon next to the node name, click the icon to view configuration issues. You must cancel cluster formation, resolve the issues, and then return to cluster formation. For example:

    Configuration Issues
    Configuration Issues

    To resolve the above issues, remove the unsupported VPN license and deploy pending configuration changes to the device.

  • VXLAN Network Identifier (VNI) Network—Specify an IPv4 subnet for the VNI network; IPv6 is not supported for this network. Specify a 24, 25, 26, or 27 subnet. An IP address will be auto-assigned to each node on this network. The VNI network is the encrypted virtual network that runs on top of the physical VTEP network.

  • Cluster Control Link—Choose the physical interface you want to use for the cluster control link.

  • Virtual Tunnel Endpoint (VTEP) Network—Specify an IPv4 subnet for the physical interface network; IPv6 is not supported for this network. The VTEP network is a different network than the VNI network, and it is used for the physical cluster control link.

  • VTEP IPv4 Address—This field will be auto-populated with the first address on the VTEP network.

  • Priority—Set the priority of this node for control node elections. The priority is between 1 and 100, where 1 is the highest priority. Even if you set the priority to be lower than other nodes, this node will still be the control node when the cluster is first formed.

Step 4

For Data Nodes (Optional), click Add a data node to add a node to the cluster.

You can form the cluster with only the control node for faster cluster formation, or you can add all nodes now. Set the following for each data node:

  • Node—Choose the device that you want to add.

    Note

    If you see an Error (error icon) icon next to the node name, click the icon to view configuration issues. You must cancel cluster formation, resolve the issues, and then return to cluster formation.

  • VTEP IPv4 Address—This field will be auto-populated with the next address on the VTEP network.

  • Priority—Set the priority of this node for control node elections. The priority is between 1 and 100, where 1 is the highest priority.

Step 5

Click Continue. Review the Summary, and then click Save.

The cluster bootstrap configuration is saved to the cluster nodes. The bootstrap configuration includes the VXLAN interface used for the cluster control link.

The cluster name shows on the Devices > Device Management page; expand the cluster to see the cluster nodes.

Cluster Management
Cluster Management

A node that is currently registering shows the loading icon.

Node Registration
Node Registration
You can monitor cluster node registration by clicking the Notifications icon and choosing Tasks. The Firewall Management Center updates the Cluster Registration task as each node registers.

Step 6

Configure device-specific settings by clicking the Edit (edit icon) for the cluster.

Most configuration can be applied to the cluster as a whole, and not nodes in the cluster. For example, you can change the display name per node, but you can only configure interfaces for the whole cluster.

Step 7

On the Devices > Device Management, Cluster screen, you see General and other settings for the cluster.

Cluster Settings
Cluster Settings
See the following cluster-specific items in the General area:

  • General > Name—Change the cluster display name by clicking the Edit (edit icon).

    Then set the Name field.

  • General > View—Click the View link to open the Cluster Status dialog box.

    The Cluster Status dialog box also lets you retry data unit registration by clicking Reconcile All.

Step 8

On the Devices > Device Management and then click Add > Device, you can choose each member in the cluster from the top right drop-down menu and configure the following settings.

Device Settings
Device Settings
Choose Node
Choose Node

  • General > Name—Change the cluster member display name by clicking the Edit (edit icon).

    Then set the Name field.

  • Management > Host—If you change the management IP address in the device configuration, you must match the new address in the Firewall Management Center so that it can reach the device on the network. First disable the connection, edit the Host address in the Management area, then re-enable the connection.

Step 9

If you deployed your cluster nodes without enabling jumbo-frame reservation, then restart all cluster nodes to enable jumbo frames, which are required for the cluster control link. See Shut Down or Restart the Device.

If you previously enabled jumbo-frame reservation, you can skip this step.

Because the cluster control link traffic includes data packet forwarding, the cluster control link needs to accommodate the entire size of a data packet plus cluster traffic overhead (100 bytes) and VXLAN overhead (54 bytes). When you create the cluster, the MTU is set to 154 bytes higher than the highest data interface MTU (1654 by default). If you later increase the data interface MTU, be sure to also increase the cluster control link MTU. For example, because the maximum MTU is 9198 bytes, then the highest data interface MTU can be 9044, while the cluster control link can be set to 9198. See Configure the MTU.

Note

Make sure you configure switches connected to the cluster control link to the correct (higher) MTU; otherwise, cluster formation will fail.