Add system communication interfaces for Master NGFW Engines

You must add at least one layer 3 Physical Interface for the Master NGFW Engine’s own communications.

Physical Interfaces correspond to network ports on the Master NGFW Engine. By default, the numbering of the Physical Interfaces in the Management Client corresponds to the operating system interface numbering on the engine. For example, Interface ID 0 is mapped to eth0, and Interface ID 1 is mapped to eth1. However, the mapping is not fixed and you can change it through the engine command line.

The types of Physical Interfaces that you can define for the Master NGFW Engine’s own communications depend on the role of the hosted Virtual NGFW Engines:

Table 1. Master NGFW Engine layer 3 interface types for system communication
Hosted Virtual NGFW Engine Role Master NGFW Engine Interface Type Explanation
Virtual Firewall None Corresponds to a single network interface on the Master NGFW Engine appliance.
Aggregated Link in High Availability Mode Represents two interfaces on the Master NGFW Engine appliance.

Only the first interface in the aggregated link is actively used. The second interface becomes active only if the first interface fails.

If you configure an Aggregated Link in High Availability mode, connect the first interface to one switch and the second interface to another switch.

Aggregated Link in Load Balancing Mode Represents up to eight interfaces on the Master NGFW Engine appliance.

All interfaces in the aggregated link are actively used and connections are automatically balanced between the interfaces.

Link aggregation in the Load Balancing Mode is implemented based on the IEEE 802.3ad Link Aggregation standard. If you configure an Aggregated Link in Load Balancing Mode, connect all interfaces to a single switch. Make sure that the switch supports the Link Aggregation Control Protocol (LACP) and that LACP is configured on the switch.
Virtual IPS Normal Interface Corresponds to a single network interface on the Master NGFW Engine appliance. Only Normal Interfaces can be used for Master NGFW Engine system communications when the hosted Virtual NGFW Engines are in the Virtual IPS role.
Virtual Layer 2 Firewall Normal Interface Corresponds to a single network interface on the Master NGFW Engine appliance. Only Normal Interfaces can be used for Master NGFW Engine system communications when the hosted Virtual NGFW Engines are in the Virtual Layer 2 Firewall role.

If the Master NGFW Engine is a cluster, it is recommended to add at least two layer 3 Physical Interfaces for the Master NGFW Engine:

  • An interface for communications between the Management Server and the Master NGFW Engine.
    Note: We recommend that you do not use the IP address of an Aggregated Link interface as the primary or secondary control IP address of the engine.
  • An interface for the heartbeat communications between the Master NGFW Engine nodes. The heartbeat traffic is critical to the functioning of the cluster, so it is highly recommended to have a dedicated heartbeat interface.

  For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Right-click a Master NGFW Engine, then select Edit <element type>.
  2. In the navigation pane on the left, browse to Interfaces.
  3. Click Add, then select Layer 3 Physical Interface.
  4. From the Type drop-down list, select the interface type according to the role of the Virtual NGFW Engines that the Master NGFW Engine hosts.
  5. Define the Physical Interface properties.
    Do not select a Virtual Resource for an interface that is used for the Master NGFW Engine’s own communications.
    CAUTION:
    Make sure that you set the Interface speed correctly. When the bandwidth is set, the Master NGFW Engine always scales the total amount of traffic on this interface to the bandwidth you defined. The bandwidth is scaled even if there are no bandwidth limits or guarantees defined for any traffic.
  6. Click OK.
    The Physical Interface is added to the interface list.
  7. Continue the configuration in one of the following ways:
    • If you want to use VLANs on this Physical Interface, add the VLANs before adding IP addresses.
    • Otherwise, add IP addresses directly to the Physical Interfaces for Master NGFW Engine system communications.