NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
M4300 SFP Port Trunking Issues
Hi all, I recently purchased 2 new M4300 and form a stack. After stacking the SW, I started to setup the switch as normal, the management VLAN, IP, the rest of vlan, subnet of those VLAN. Since i...
Hi Kelvin,
It's a good news that the failover problem resolved.:smileyhappy:
Let's carry on the VRRP scenario.
I have checked the maintenance file just you sent to us.
1) Congratulation！The address (192.168.100.2 ) is the virtual IP address of VRRP on Firewall.
Because this IP have same prefix mac-address header just like (00:00:5E:00:xx:xx).
It's the standard of VRRP for mac-address behavior.
2) Good finding! The "Link state detection” is very useful for VRRP status.
So we need to set the IP for heartbeat on each Firewall that could monitor VRRP all the time.
But 192.168.100.1 is not the heartbeat address for Firewall that is VLAN interface on M4300-Stack.
So Could you set an IP address on Firewall A and B that is not VRRP protocol.
Such as:
192.168.100.10 /24 on Firewall A.
192.168.100.20 /24 on Firewall B.
Then,
Set Link state detection IP address to 192.168.100.20 on Firewall A.
Set Link state detection IP address to 192.168.100.10 on Firewall B.
That will make Firewall detect each other with this configuration.
3) Could you share me the configuration page or command on your Firewall about LAG/Port/IP address/VRRP configuration？
The private message is RECOMMENDED.
I'm not very professional on Firewall of other company.
Just want to help analyze.:smileyhappy:
Look forward to your reply.
Regards,
Daniel.
Hi Daniel,
I fixed the failover problem by enabling the dynamic LACP mode in both stack and layer 2 switch. Awesome!
for the question 1, I would like to reply the your suggestion first
1. Yes, master and slave a connect with same subnet address and has 1s heartbeat to detect each other
2. and 3. The firewall doesn't have virtual IP, it not the same as the VRRP standard protocol, instead, they sync the setting from each other, that means firewall A and B has the exact same setting except the heartbeat interface, so the only way I can identify them are the heartbeat interface. also, when I have switch and connect both firewall at the same time with the eth ip address, i'm always connected to the firewall A if it is in normal state, once it failed, i will redirect to firewall B. in this situation, the virtual ip is not a must I think?
4. I cannot find any setting on the Firewall about dynamic LACP (I think this is the key), the firewall has the option called "Link state detection" which allow me to set an IP address to have periodic check like heartbeat, I set 192.168.100.1 in that field
5. Yes, I have this setup and it's already enabled
Test
1. unplug eth 3 / 4 at the same time in Firewall A
yes, Firewall B became Active, and LAG to Firewall A was down in switch stack, LAG to Firewall B is still up, when I plug back eth 3 and 4 at Firewall A, it become Active again, and B to standby (So, it obviously detect the link failure!!!!)
2. set LAG to Firewall A and B to dynamic LACP
since I don't have any setting that allow me to enable dynamic LACP, yes, the state was changed to down as expected
I think LACP is the key but I cannot prove it, I'm going to upload my log, you may have a check on it. Thanks for helping me a lot
Hi Kelvin,
It's a good news that the failover problem resolved.:smileyhappy:
Let's carry on the VRRP scenario.
I have checked the maintenance file just you sent to us.
1) Congratulation！The address (192.168.100.2 ) is the virtual IP address of VRRP on Firewall.
Because this IP have same prefix mac-address header just like (00:00:5E:00:xx:xx).
It's the standard of VRRP for mac-address behavior.
2) Good finding! The "Link state detection” is very useful for VRRP status.
So we need to set the IP for heartbeat on each Firewall that could monitor VRRP all the time.
But 192.168.100.1 is not the heartbeat address for Firewall that is VLAN interface on M4300-Stack.
So Could you set an IP address on Firewall A and B that is not VRRP protocol.
Such as:
192.168.100.10 /24 on Firewall A.
192.168.100.20 /24 on Firewall B.
Then,
Set Link state detection IP address to 192.168.100.20 on Firewall A.
Set Link state detection IP address to 192.168.100.10 on Firewall B.
That will make Firewall detect each other with this configuration.
3) Could you share me the configuration page or command on your Firewall about LAG/Port/IP address/VRRP configuration？
The private message is RECOMMENDED.
I'm not very professional on Firewall of other company.
Just want to help analyze.:smileyhappy:
Look forward to your reply.
Regards,
Daniel.
PM was setn:smileyhappy:
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
