Assign IP at HA Firewall

[f0r7y]

Hi I have created a virtual chassi whit 2 firewalls (master/slave) How ca I assign same IP to same interface (WAN 1) of 2 firewall?

[Kludge-As-A-Service]

Have a look at FHRP groups.

[f0r7y]

Thanks
One group for each port?

do the 2 devices have to be included in a virtual chassis?

[Kludge-As-A-Service]

One single FHRP group, as the FHRP Group is the item that makes the relation between the devices and the IP address.
No virtual chassis, virtual chassis have nothing to do with that at all.

[f0r7y]

Ok Thanks. But without virtual how can I manage master and slave device?

[f0r7y]

Create an FHRP group, assign the IP address to it, then go editing the interface of your firewalls and from there you can assign the FHRP group to the interfaces. For better visibility, you may also want to enable the "FHRP groups" column in the interface list view.

One Group forn each WAN and One group forn each LAN?

[f0r7y]

With 1 FHRP Group assign to 2 interface (WAN1 and LAN1) to each firewall (total 4 assignments), when I go to details of an interface (firewall 1, LAN1 for example) I see this in attachment. So, I cannot understand which IP is assigned to the interface LAN or WAN. Maybe I'm still doing something wrong

[mtinberg]

FHRP Group interface assignments have a priority field to help you track which physical interface/device is the primary and which is the standby. — Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison

…

________________________________ From: Matteo ***@***.***> Sent: Wednesday, August 31, 2022 11:09 AM To: netbox-community/netbox ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [netbox-community/netbox] Assign IP at HA Firewall (Discussion #10210) Ok Thanks. But without virtual how can I manage master and slave device? — Reply to this email directly, view it on GitHub<#10210 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAS7UMYGGXLMEVLRK3CSZSDV357VJANCNFSM6AAAAAAQAFHGXI>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[mtinberg]

I create FHRP groups for each pair of interfaces, even if the HA for the device fails over all of the interfaces and they don't have individual failover, so there isn't confusion. FHRP Protocol and Group ID are mandatory fields, but Group ID is not required to be unique so I differentiate using the Description "HA-${cluster_name}-${interface_name}" and the paired devices are associated with each other using Virtualization Clusters. So you'd have two FHRP groups, one for the two WAN interfaces (Description: HA-internet-WAN) and one for the two LAN interfaces (Description: HA-internet-LAN), they can both be Group ID 1, then there is no confusion. You can then query Netbox interfaces, pull the IPs and FHRP groups associated with any individual interface, and build the right config for that interface. — Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison

…

________________________________ From: Matteo ***@***.***> Sent: Friday, September 2, 2022 9:18 AM To: netbox-community/netbox ***@***.***> Cc: Mark Tinberg ***@***.***>; Comment ***@***.***> Subject: Re: [netbox-community/netbox] Assign IP at HA Firewall (Discussion #10210) With 1 FHRP Group assign to 2 interface (WAN1 and LAN1) to each firewall (total 4 assignments), when I go to details of an interface (firewall 1, LAN1 for example) I see this in attachment. So, I cannot understand which IP is assigned to the interface LAN or WAN. Maybe I'm still doing something wrong [2022-09-02 16_14_28-port1 (LAN-VLAN_2) _ NetBox]<https://user-images.githubusercontent.com/110922392/188169156-74158315-cbb7-49a0-8a62-67d1e1304cd4.png> — Reply to this email directly, view it on GitHub<#10210 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAS7UM3FZPZ3HZ5XO567METV4IEE5ANCNFSM6AAAAAAQAFHGXI>. You are receiving this because you commented.Message ID: ***@***.***>