[Full-disclosure] clustering question

[Bill Stout]

This is security related?

Clustered firewall/vpn appliances have to be the same family as they replicate configuration (and sometimes state info) to each other.  Usually the size of the appliance is related to user licenses and options like SSL accelleration, so from the hardware perpsective they have to have the same components.

[Early '90s' answer]  If you're talking about a firewall configuration, as long as the services failover differently sized systems will be fine.  The cluster can be full capacity when both are up, and operate in degraded capacity mode with all services running on one server, or if a service fails over to a smaller system it will run in degraded mode.  I configured a Dec Seal1 gatekeeper cluster on Digital Ultrix for a west coast bank way back when, they had some services (FTP, SSL) on one server and other services on a another (NTP, SMTP).  The clustering software handled service (screend) and virtual IP failover and the configuration files on the shared RAIDset.  The systems were equally sized.  I haven't seen an application firewall cluster since then.

Bill Stout

----- Original Message ---- 
From: shadow floating <nadengine at googlemail.com> 
To: full-disclosure at lists.grok.org.uk 
Sent: Tuesday, February 26, 2008 5:35:17 AM 
Subject: [Full-disclosure] clustering question 

Hi all, 
just a simple question 
when i'm building a cluster, do i have to have all machines in the 
cluster be exactly the same capacity ,configuration and brand? (cpu 
power, storage,network connectivity and memory) 
thank alot 

regards, 

_______________________________________________ 
Full-Disclosure - We believe in it. 
Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
Hosted and sponsored by Secunia - http://secunia.com/