Hardware Failover License Synchronization
Synchronization provides a way to share SonicWall security services licenses between two appliances when one is acting as a hardware failover system for the other. To use this feature, you must register the SonicWall appliances on MySonicWall.com as associated products. Both appliances must be the same SonicWall model, and both must be separately licensed for SonicOS Enhanced.
License synchronization allows your network security services to continue uninterrupted during a hardware failover. You can use the SonicOS user interface (UI) to enable hardware failover and configure the two appliances in active/passive mode. Two appliances configured in this way are also known as a high availability (HA) pair.
Benefits
Hardware failover license synchronization is a cost-effective option for deployments that provide high availability by using redundant SonicWall security appliances. You do not need to purchase a second set of security services licenses for the passive unit in an HA pair.
How Does License Synchronization Work?
Hardware failover license synchronization copies the licenses from the primary SonicWall appliance to the associated secondary appliance. All services you see on the Security Services > Summary screen are shareable, including free trial services. When failover occurs, the secondary appliance is licensed and ready to take over network security operations.
Note: Neither the SonicOS Enhanced nor the SonicWall Support licenses can be shared. Both the primary and the secondary appliances must be licensed separately.
Platforms
Hardware failover license synchronization is currently available when running SonicOS Enhanced on the following SonicWall security appliances:
- CSM 2100
- CSM 2200
- CSM 3200
- PRO 2040
- PRO 3060
- PRO 4060
- PRO 4100
- PRO 5060
Configuration Overview
Configure hardware failover license synchronization by associating two SonicWall security appliances as HF primary and HF secondary on MySonicWall.com. You must purchase a single set of security services licenses for the HF primary appliance.
License synchronization is used during hardware failover so that the secondary appliance can maintain the same level of network protection provided before the failover. To enable failover, use the SonicOS UI to configure your two appliances as an HA pair in active/passive mode.
MySonicWall.com provides several methods of associating the two appliances:
- Register a new appliance, and then choose an already-registered unit to associate it with.
- Associate two units that are both already registered.
- Select a registered unit and thenadd a new appliance with which to associate it.
You can remove an appliance from an association at any time.
Associating an Appliance at First Registration
To register a new SonicWall appliance and associate it as a secondary unit to an existing primary unit for failover license synchronization, perform the following steps:
- Log in to MySonicWall.com.
- On the main page, under Quick Register, type the appliance serial number and then press Enter or click the arrow button.
- On the My Products page, type the friendly name for the appliance and its authentication code, and then click Register.
- On the Create Association page, select the appliance that will act as the primary unit in the HA pair. You can skip this step if you want your new appliance to be primary.
- Select a choice for HF secondary, and then click Continue. Your new appliance will be the HF primary unit for the device that you select.
- Verify that your product registered successfully and verify the correct appliance and serial number for the parent (or child, if you chose that option).
Associating Pre-Registered Appliances
To associate two already-registered SonicWall security appliances so that they can use license synchronization, perform the following steps:
- Log in to MySonicWall.com.
- Click View all registered products.
- On the My Products page find the appliance that you want to use as the primary unit. Click the product name or serial number.
- Under Associated Products, click HF Secondary.
- On the My Product - Associated Products page, under Associate New Products, type the serial number and the friendly name of the appliance that is the secondary, unit.
- Click Register.
Associating a New Unit to a Pre-Registered Appliance
This section describes how to add a new appliance on the My Product - Associated Products page to an already-registered SonicWall security appliance, and associate the two appliances so that they can use license synchronization. You can add a new secondary unit to an existing primary unit, or add a new primary unit to an existing secondary unit. To use this method, perform the following steps:
- Log in to MySonicWall.com.
- Click View all registered products.
- On the My Products page, find the appliance that you want to use as the existing unit and click its product name or serial number. You can choose any supported appliance on the list, whether it is already an HF primary or an HF secondary, or neither.
- On the Service Management - Associated Products page do one of the following:
- If the existing unit is an HF primary or an unassociated appliance, click HF Secondary.
- If the existing unit is an HF secondary appliance, click HF primary.
- On the My Product - Associated Products page, enter the serial number and friendly name of the new appliance that you want to register as the associated unit.
- Click Register.
- On the Create Association page, select the appliance with which you want to associate the new unit. If you selected an existing HF primary unit or unassociated unit earlier, the choices here will all be HF primary. If you selected an existing HF secondary unit, the available selections here are HF secondary units.
- Click Continue.
- On the Service Management - Associated Products page, confirm at the top that the registration was successful, and then click either HF Primary or HF Secondary to display the unit(s) that are now associated with your newly registered appliance.
Removing an HF Association
You can remove the association between two appliances on MySonicWall.com at any time. You might need to remove an existing HF association if you replace an appliance or reconfigure your network. You must first remove the existing HF association and then create a new association that either uses a new appliance, or changes the parent-child relationship of the two units.
To remove the association between two registered SonicWall security appliances, perform the following steps:
- Log in to MySonicWall.com.
- Click View all registered products.
- On the My Products page, find the secondary appliance from which you want to remove associations. Click the product name or serial number.
- On the Service Management - Associated Products page, click Remove, wait for the web page to reload, and then click Remove again.
Replacing a SonicWall Security Appliance
If your appliance has a hardware failure while still under warranty, SonicWall will replace it. In this case, you must remove the HF association containing the failed appliance on MySonicWall.com, and add a new association that includes the replacement. If you contact SonicWall Technical Support to arrange the replacement (known as an RMA), Support will often take care of this for you.
After replacing the failed appliance in your equipment rack with the new unit, you can update MySonicWall.com and your SonicOS configuration.
Replacing a failed HF primary unit is slightly different than replacing a secondary one. Both procedures are provided next.
Replacing an HF Primary Unit
To replace a primary unit, follow these steps:
- In the SonicOS management interface of the remaining SonicWall security appliance (the backup unit), on the Hardware Failover screen, clear the Enable Hardware Failover setting.
- Clear the Backup SonicWall Serial Number text box.
- Select the Enable Hardware Failover check box. The old backup unit now becomes the primary unit, and its serial number is automatically displayed in the serial number text box.
- Type the serial number for the replacement unit into the Backup SonicWall Serial Number text box.
- Click Synchronize Settings.
- On MySonicWall.com, remove the old HF association.
- Register the replacement SonicWall security appliance and create an HF association with the new primary (original backup) unit as the HF primary, and the replacement unit as the HF secondary.
- Contact SonicWall Technical Support to transfer the security services licenses from the former HF pair to the new HF pair. This step is required when the HF primary unit has failed, because the licenses are linked to the primary unit in an HF pair.
Replacing an HF Secondary Unit
To replace an HF secondary unit, follow these steps:
- On MySonicWall.com, remove the old HF association.
- Register the replacement appliance and create an HF association with the original HF primary, using the replacement unit as the HF secondary.
Configuring Hardware Failover on SonicOS
License synchronization is designed for use during a hardware failover. To enable this potential benefit, you must configure hardware failover in the SonicOS UI using the two associated SonicWall appliances.
A basic configuration procedure is provided below. For complete information about setting up hardware failover, including details about ports and IP address requirements, see the SonicOS Enhanced Administrator’s Guide for version 3.2 or later.
To configure hardware failover in SonicOS:
- Log in as an administrator to the SonicOS user interface on the primary SonicWall appliance.
- Click Hardware Failover.
- On the Hardware Failover > Settings screen, select Enable Hardware Failover.
- To back up the firmware and settings when you upgrade, check Generate/Overwrite Backup Firmware and Settings When Upgrading Firmware.
- Adjust time or heartbeat settings in the four text boxes.
- Enter the serial number for the backup SonicWall appliance. (You can find the number on the back of the SonicWall security appliance. The number for the primary SonicWall is automatically populated.
- Click Synchronize Settings.
Applying Licenses to SonicWall Security Appliances
When you register an appliance on MySonicWall.com, a license keyset is generated for the appliance. If you add a new service license, the keyset is updated. However, until you apply the licenses to the appliance, it cannot perform the licensed services. This section describes two methods of applying the licenses to a SonicWall security appliance.
Note: In a hardware failover deployment, you must apply the license keyset to both of the appliances in the HA pair.
Use one of the procedures below to apply a license keyset to an appliance.
Copying the License Keyset from MySonicWall.com
Follow these steps to view the license keyset on MySonicWall.com and copy it to the appliance:
- Log in to MySonicWall.com.
- Click View all registered products.
- On the My Products page, click the product name or serial number of the appliance to which you want to copy the license keyset.
- On the Service Management - Associated Products page, click View License keyset.
- Use your mouse to highlight all the characters in the text box. This is the license keyset for the appliance that you selected earlier.
- To copy the license keyset to the clipboard, press Ctrl+C.
- Log in to the SonicOS user interface.
- On the Systems > Licenses page, paste the license keyset into the text box, and then click Submit.
Activating Licenses from the SonicOS User Interface
Follow these steps to activate licenses from within the SonicOS user interface:
- Log in to the SonicOS user interface.
- On the System > Licenses page, click the link for activating, upgrading or renewing services.
- On the System > Licenses page, enter your MySonicWall.com user name and password, and then click Submit.