Firewall in a clustered nodes.

[RAC_1]

Some Back ground.

HP-UX 11.11 on superdomes running under SG cluster.(A.01.02)
Node-1 runs Apache web server and OAS. Node-1 runs Oracle 8.1.7(db server)

Node-3 also running apache and OAS.

Now network team is planning to put one firewall between clustered nodes. i.e node-1 running apache,OAS and node-2-oracle db server.

Info required.

What measures/precautions do I need to take for proper operation of SG environment.
(please note that node-3 is not under SG, but just a load balancing server for node-1)

What ports do I need to open, and more importantly what precations do I need to take under SG environment.

node-2 database server gets request from node-1 and node-3.

Thanks in advance.

[John Poff]

Hi,

Why do they want to put a firewall between two of your MC/SG nodes? What problem is your network team trying to solve?

JP

[RAC_1]

Really nothing. Did not listen to Sysadmins.

It is so called part of securing the web site these servers host.

[MANOJ SRIVASTAVA]

Why dont you use Local Director and free up a server.


Manoj Srivastava

[RAC_1]

Pardon my knowledge,

But no idea what local director is.
But we do have SSL(hp make)
for load balancing the web requests between node-1 and node-3 and for secure connections.

[MANOJ SRIVASTAVA]

How about A CISCO 430 , I think there are smaller verrsions avaialbel too,




Manoj Srivastava

[U.SivaKumar_2]

Hi,

These are the ports MC/Serviceguard uses

Ref: /etc/services

hacl-hb 5300/tcp # High Availability (HA) Cluster heartbeat
hacl-gs 5301/tcp # HA Cluster General Services
hacl-cfg 5302/tcp # HA Cluster TCP configuration
hacl-cfg 5302/udp # HA Cluster UDP configuration
hacl-probe 5303/tcp # HA Cluster TCP probe
hacl-probe 5303/udp # HA Cluster UDP probe
hacl-local 5304/tcp # HA Cluster Commands
hacl-test 5305/tcp # HA Cluster Test
hacl-dlm 5408/tcp # HA Cluster distributed lock manager

Put the heartbeat lines through two serial interface rather than ethernet cables.

If you have IP failover setup between the nodes across firewall , in my opinion you will have hard time ... :-)

regards,
U.SivaKumar

[melvyn burnard]

I stronly advise against having a firewall set up BETWEEN Sg nodes.
No problem if you want one outside the cluster, but if you set it up to act between the nodes, then you may have some problems.
Bear in mind, most firewalls get set to block things like UDP broadcasts etc, and SG does use these.