LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 05-18-2005, 02:12 PM   #1
jlinkels
Senior Member
 
Registered: Oct 2003
Location: Bonaire
Distribution: Debian Lenny/Squeeze/Wheezy/Sid
Posts: 4,087

Rep: Reputation: 492Reputation: 492Reputation: 492Reputation: 492Reputation: 492
Stand-by machine in case real machine crashes


Hello all,

I am planning to create a machine to take over the functions of my firewall/router in case the real machine crashes.

The situation is this:

I have two sites, site A and site B. Both site A and site B have an internet connection. At both sites I have a firewall to connect the internal network to the internet. Both firewalls are connected thru a wireless connection using a wireless card in both machines.

At site A I have a total of 3 NIC's in the machine (LAN, internet and wireless). At site B I have 4 NIC's in the machine. (2 LAN's, internet and wireless).

LAN-A and LAN-B are interconnected thru the wireless link. Access is somewhat restricted, that is, not all parts of both LANs are allowed to see each other. Both LAN-A and LAN-B are able to use the internet connection on both sites.

Both firewalls run a traffic shaper, but are configured differently. The firewall at site A runs a DNS server, a DHCP server and a traffic log.

This all sounds complicated, but unfortunately it is necessary. It all works perfect. The point is that both machines are very similar, but yet have a lot of differences in the configuration.

What I now need to do is to be prepared for disaster. My entire company is relying on the wireless connection and the internet connections. I have to be prepared that one firewall will be completely defective , and that it should be replaced by a different machine.

So... what would be the best way to have a stand-by machine prepared and completely updated with the configuration of the real machine? I am sure calling for a disaster if do not provide some update mechanism between the real and the stand-by machine. Configurations tend to drift, and the stand-by machine might remain unused for years (or forever hopefully).

The current idea is this:

I build another machine, and install 3 complete Linux installations on it.
1. as stand-by machine doing nothing
2. as firewall A
3. as firewall B
Each installation would be completely independent.

When booting, you can choose which function the machine will perform. As long as the machine is not needed, it is configured as stand-by, doing nothing and connected to the LAN. This machine can however access the partitions which are used for firewall A and firewall B.

Both firewalls A and B do a daily rsync of the important directories with the corresponding directories on the stand-by machine. As soon as one of the machines fail, I would take the stand-by machine, connect it in place of the defective one and boot for the correct function.

This means that a hot stand-by is not necessary. I always have access to both sites, and can afford to go down to the site and put the replacement there. However, it should be a no-brainer and no configuration should be necessary. This precludes having an "empty machine" on which I should restore a backup before I can use it.

I am not too economical to have 2 machines as spare, but since it should be connected to the network for updates, I think I still need two Linux installations on each machine, one for running as stand-by and receiving updates, and one as replacement for the defective machine. So having 2 machines would only increase my manageability problem.

Any comments or better ideas someone?

jlinkels
 
Old 05-19-2005, 08:28 AM   #2
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654Reputation: 654
Try googling for "failover firewalls". You'll find similar links.

http://www.keepalived.org/

http://www.innertek.com/fcluster/
http://www.samag.com/documents/s=9658/sam0505e/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
configuring X11 and x11vnc on a machine without any real input/output AlexiaDeath Linux - Software 1 10-26-2004 01:45 AM
HCL add motherboard or machine type in case of an IBM? merlin740 LQ Suggestions & Feedback 2 10-04-2004 12:11 PM
FC1: Any sound playing crashes my machine... plainmedici Fedora 0 06-29-2004 06:59 AM
Any distro crashes in my machine Mega Man X Linux - Hardware 13 05-20-2003 12:00 PM
VCDs crashes my machine lippy Linux - General 1 03-14-2003 11:36 AM


All times are GMT -5. The time now is 03:13 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration