Cluster and Failover Setup

On this page it is explained how the cluster (the HA pair) structure is installed between two TR7 devices on Azure and how the failover permissions needed by every device are given. After the cluster is installed, the VIP Setup page is followed in order to create a VIP.

The Cluster Installation

1

Step 1 Deploy two TR7 VMs

Two TR7 VMs are deployed (see Deployment Guide). It is made sure that the two VMs are within the same VNet. This operation produces two machines each with a single interface; their management interfaces must be on the same network.

2

Step 2 Add the sync interface

Both machines are stopped and a new interface is added to each of them. This interface must be in a different subnet from the subnet assigned to the management interface. The interfaces added must be on the same network as well (with each other).

The machines are turned on again and a login is made.

3

Step 3 Select the Sync interface on the first device

On the first device the Settings → Device Management → Hardware Management screen is gone to from the Configuration Menu at the bottom left.

The Edit OFF button is clicked. The interface added before is selected as the Sync interface. The interface can be recognized from its MAC address; additionally, the interface that does not have an IP under Usage is the interface added. After the setting is made, the Save button is clicked. A login is asked again and a login is made.

4

Step 4 Select the Sync interface on the second device

The same menu is opened on the second device: Settings → Device Management → Hardware Management.

The Edit OFF button is clicked and the interface added before is selected as the Sync interface (it is recognized from its MAC address or from its not having an IP under Usage). The Save button is clicked and a login is made again.

5

Step 5 Enable the cluster on the first device

The sync interfaces are now set on both devices. On the first device the Settings → Device Management → HA Clustering & Sync screen is gone to.

The Edit button is clicked. The cluster is enabled and, since this is the first device, the Cluster ID value is made 1. In the Peer device private IP (cloud) field the management (private) IP of the second device on Azure is entered. Then the Submit button is clicked.

6

Step 6 Enable the cluster on the second device

On the second device the Settings → Device Management → HA Clustering & Sync screen is gone to.

The Edit button is clicked. The cluster is enabled and, since this is the second device, the Cluster ID value is made 2. In the Peer device private IP (cloud) field the management (private) IP of the first device on Azure is entered. Then the Submit button is clicked.

7

Step 7 Match the management IPs

On the first device the Network → Interfaces screen is gone to. The IP of the management interface is right clicked and Edit is selected. In the area reserved for the second device the IP of the management interface of the second device is entered and the Edit IP button is clicked. These IPs must be the private IP addresses on Azure. On the second device no operation needs to be made for now.

WARNING

Even if the operation returns an error, there is no need to worry; the error disappears when the next step is completed.

8

Step 8 Restart the configuration services

On the first device the Settings → Device Management → Local Services screen is gone to and the Restart configuration service button on the left is clicked.

Then the same operation is made on the second device: Settings → Device Management → Local Services → Restart configuration service.

The Failover Permissions

For the VIP to be able to be carried automatically to the other device when a device goes out of service, TR7 must be able to carry this IP on Azure. In order to provide this, an identity and a role are given to every device on Azure. The identity and role steps are made from the Azure portal; if the outbound traffic passes through a firewall, the access rule in the last step is defined on that firewall.

1

Step 1 Give the identity and the roles to the first device

The page of the first device (the VM) is gone to on the Azure portal. From the left menu the Security → Identity → Status field is made On and the Save button is clicked. Then, on the same page, Azure role assignments under Permissions and Add role assignment are clicked. The Scope field is made Resource group; the Subscription and the Resource group in which the device is located are selected. Both of the Reader and Network Contributor roles, each one as a separate role assignment, are added and saved.

2

Step 2 Give the identity and the roles to the second device

The same steps are repeated for the second device.

3

Step 3 The outbound access on the firewall

For the failover to work, every device must be able to access the Azure management endpoint. In order to carry the VIP, TR7 calls the Azure Resource Manager API at the management.azure.com address over 443/TCP.

In most environments no additional setting is needed, because Azure allows the outbound internet traffic by default. But if the outbound traffic is forced to pass through a firewall and if this firewall refuses the traffic by default, an outbound allow rule must be added for management.azure.com : 443/TCP. This situation usually occurs with a User-Defined Route that sends the 0.0.0.0/0 traffic to a firewall.

The rule field	Value
Source	The management interface private IPs of the two devices or the management subnet CIDR that covers both
Destination	The management.azure.com FQDN or the AzureResourceManager service tag
Port / Protocol	443 / TCP
Direction	Outbound

• It is not fixed to a destination IP address. The management.azure.com endpoint does not have a single fixed IP address; Microsoft uses a wide and changing pool of IP ranges. For this reason the AzureResourceManager service tag or the FQDN is used in the rule.
• The source is the management interface. The Azure Resource Manager call goes out from the interface that carries the default routing, that is, from the management (primary) interface; it does not go out from the sync or data interface.
• Both devices are added as the source. Since the active device can change at any moment, the management private IP of both devices is written into the rule or the management subnet CIDR is used.

If there is no rule, the failover does not work

If this rule is missing in an environment in which it is needed, when the active device goes out of service the backup device cannot take over the VIP.

When is this rule not needed?

The rule is needed only in the cluster installations that pass through a firewall that refuses the outbound traffic by default. A single (non-cluster) TR7 never makes this call and does not require a rule. The Azure IMDS endpoint (169.254.169.254) used to take the identity token is a link-local address; it is not affected by the NSG, the firewall and the routings, and a rule is never needed for it.

When the permissions are completed, it is passed to the VIP Setup page in order to create a VIP.