Configuring HA

High Availability has the following limitations:

• HA does not work on machines running the Solaris 7 operating environment for the Intel Platform.

• Screens in an HA cluster do not exchange state information, they accumulate state independently by processing the same packets. For optimal performance, whenever possible, an HA cluster should comprise systems of equal size (same CPU speed, and memory size). A slower Screen in passive mode can fall behind in processing and eventually fail to have the same state as the active Screen.

• To reinstate a repaired Screen, install it as a secondary Screen and add it to the cluster.

You do not have to switch back to the original Screen except when its abilities or speeds are better. If they are, you can force the faster machine to take over as the active Screen, or wait until both machines have the same state (eventually the out-of-sync connections will time-out and become synchronized) and force the failover.

• Secrets are sent in the clear on the dedicated HA network to facilitate administrative communication within the HA cluster. Reserving the HA interface as a separate network from other traffic helps prevent discovery of the Screen's private certificates.

• Each Screen in an HA cluster must have a unique node name and a unique IP address on the dedicated HA network. All other aspects of the Solaris system configurations must be identical on all Screens in the HA cluster. This includes the configuration of all network interfaces (other than the HA interface).

• HA does not work well with proxies because proxy state tables are not present on all HA machines.

• HA Screens must be connected to each other through a shared network (such as a 10BaseT or 100BaseT hub) and not through a switched network (such as an Ethernet switch) because it will send each packet to only one HA Screen, rather than to all of them.

• HA cannot be used on networks that use media other than Ethernet, such as FDDI, Token-Ring, or ATM.

• Because passive HA hosts do not generate traffic (other than automatic administrative traffic, such as HA administration and HA heartbeat), you cannot use telnet for connecting to passive HA Screens. You can use telnet for communicating with an active HA Screen only.

• The HA cluster decides internally which member will be the active Screen.