Active/Active-Cluster Licensing Partner FAQ Author: Udo Kerst (uke) Date: 2007-05-11 Content Page Which applications are being load balanced within an Astaro Security Gateway cluster?...2 Which licenses are required for an Astaro Security Gateway cluster? 2 How do I activate clustering?...3 How can I convert an active/passive HA bundle into a cluster?...3
Which applications are being load balanced within an Astaro Security Gateway cluster? In general the following applications are being load balanced: Network Protection IPSec VPNs Intrusion Protection Web Filtering Antivirus for HTTP and FTP URL Filtering Email Filtering Antivirus for SMTP and POP3 Antispam for SMTP and POP3 The following applications will not be load balanced: Network Protection Packet Filter (Stateful firewall) Email Encryption Which licenses are required for an Astaro Security Gateway cluster? For aggregating several ASG units (either Hardware or Software appliances) into a cluster customers need to buy similar standard base licenses (for ASG software) or ASG hardware appliances (including base licenses) corresponding to the number of units that should be clustered. Secondly customers also need to buy similar subscriptions and maintenance contracts for each unit within the cluster. For instance if customers want to use Antivirus for HTTP and/or FTP within a cluster they need to buy Web Filtering subscriptions for all units within the cluster. If they want to use Antivirus and/or Antispam for SMTP and/or POP3 within a cluster they have to buy Email Filtering subscriptions for all units within the cluster. All applications of the corresponding subscription will then be load balanced automatically. 2007 Astaro AG. Subject to change without notice uke 2
Finally the license on the master node needs to be activated for the number of nodes within the cluster. This activation will be conducted by Astaro order management (as described below). Note: If Email Encryption is enabled on the master node, Email Encryption and all other SMTP applications (like Antivirus and Antispam) will be restricted to the master mode. Hence no SMTP load balancing will be done. However POP3 based applications (like Antivirus or Antispam) can still be load balanced. Hence in that case customers only need to buy Email Encryption and Email Filtering subscriptions for the master node (even if load balancing for POP3 is still possible). How do I activate clustering? In order to activate clustering for a number of interconnected ASGs Astaro partners have to contact Astaro order administration and provide all licenses IDs that their customer has purchased for the cluster (see figure 1). Astaro will then activate one of those base licenses for the corresponding number of cluster nodes and return the license ID which is intended for the master node. The customer can then download this activated license from MyAstaro (the license file should now list the number of cluster nodes at the entry ClusterNodes= in the [LicenseOption] section). After uploading the license to the master node the master will copy the license to all cluster nodes automatically. Hence from now on only this single license is used for the complete cluster. All other licenses that might have been in use for the now clustered Astaro Security Gateway units before will be expired and can no longer be used. Note: As of today Astaro is not issuing specific clustering activation keys in order to activate clustering on a base license via MyAstaro. How can I convert an active/passive HA bundle into a cluster? For an active/passive HA bundle customers only need one base license key with optional subscriptions and maintenance licenses which are activated on the master node only. In order to convert this bundle into an active/active cluster they first need to purchase similar subscriptions and maintenance 2007 Astaro AG. Subject to change without notice uke 3
licenses also for the slave node (see figure 2). When purchasing those licenses customers are getting corresponding activation keys that they should apply to the second (unused) base license that they received when purchasing an appliance bundle. To activate the clustering option, please follow the steps as described in the previous section. Similarly for Astaro Security Gateway Software customers are provided with an HA activation key for activating the HA option of the master node s base license. Hence when contacting Astaro order administration you need to provide the license ID of the master node s base license as well as the activation key(s) for the additional subscription(s) that have been bought for the slave node. 2007 Astaro AG. Subject to change without notice uke 4
Figure 1 Figure 2 This document may not be copied or distributed by any means, electronically or mechanically, in whole or in part, for any reason, without the express written permission of Astaro AG. 2007 Astaro AG. All rights reserved. Astaro Security Gateway, Astaro Command Center and WebAdmin are trademarks of Astaro AG. All further trademarks are the property of their respective owners. No guarantee is given for the correctness of the information contained in this document. 2007 Astaro AG. Subject to change without notice uke 5