Appendix A. Introduction to HACMP 343
• Shared disk
In a HA firewall setup, it is necessary to have a method to synchronize the
filter rules between two or more clustered firewall machines. A shared
disk, which was discussed in “Shared disks and shared volume groups” on
page 337, can be used in order to provide continuous access to the filter
rules. If a firewall machine fails, HACMP will take over a shared disk to
There are two disadvantages of having a shared disk. The filter rule files
are usually so small in size that most of the disk space will be wasted. The
second disadvantage is that HACMP usually takes more time to take over
a hard disk than to take over an IP address. HACMP spends most of the
time to run fsck before mounting file systems. The longer the takeover time
is, the bigger the security exposure becomes.
We decided not to use a shared disk; instead, we devised a way to
synchronize the filter rules whenever there is a change in filter rule.
Since a firewall configuration is not static and changes from time to time, it
is necessary to synchronize the firewall configuration in a high availability
The firewall configuration is made up of several files that can be viewed
and easily copied. When starting or updating the firewall, it reads its
configuration from these files. In order to synchronize the firewall
configuration, all changed files need to be copied, and the firewalls need
to be updated for the configuration changes to be activated.
When copying files to synchronize systems, there are two problems. The
first problem is that the files could have changed on multiple systems at
the same time, and there would have to be a decision made on which files
to favor and which to discard. The other problem is that when copying files,
it would be necessary to assure that all the files are correctly transferred
without any changes or information loss.
Processor type PowerPC 604e PowerPC 604e PowerPC 604e
Clock rates 332 MHz 375 MHz 332 MHz
Slots 3 PCI + 2 PCI/ISA 5 PCI 7 PCI + 2 PCI/ISA
5.3 6.0 10.0 ~ 32.8
Machine Type 43P Model 140 43P Model 150 F50