Model used to configure & monitor firewall High Availability(HA). The model is comprised primarily of the following sections - - Various global config parameters (such as ha-group-id, ha-mode etc.) - Control link configuration parameters (control link is used to exchange HA control msgs) - Data link configuration parameters (data link is used to exchange information for seamless failover) - HA timers
This model also imports/uses the link-monitoring module, to determine health of firewall cluster based on the status of the interfaces being monitored. Please see that module description for additional details
openconfig-extensions
openconfig-interfaces
openconfig-inet-types
openconfig-fw-link-monitoring
openconfig-aaa-types
openconfig-types
description:
Base type to specify the HA parameters that are not matching
amongst HA peers.
description:
Software version is not matching between HA peers.
base identity: HA_PEER_MISMATCHED_ITEM
description:
Running configuration is not matching between HA peers.
base identity: HA_PEER_MISMATCHED_ITEM
description:
IPS/IDS signatures are not matching between HA peers.
base identity: HA_PEER_MISMATCHED_ITEM
description:
AVC signatures are not matching between HA peers.
base identity: HA_PEER_MISMATCHED_ITEM
description:
Top level container for HA groups
nodetype: container (rw)
description:
HA group id used to create a logical HA group
nodetype: list (rw)
list keys: [id]
description:
References the group id key.
nodetype: leaf (list key) (rw)
type: leafref
description:
Config container for HA parameters
nodetype: container (rw)
description:
This must be set to 'true' to initiate firewall participation
in a HA cluster. Once set to 'true', this boolean can be
flipped to 'false' to DISABLE HA and put a unit in a
'suspended' state while retaining all other HA settings &
configuration parameters. At the same time the 'ha-state' leaf
under 'ha-parameters-state' must then be updated to
'SUSPENDED'
nodetype: leaf (rw)
type: boolean
default: false
description:
Configurable HA modes
nodetype: leaf (rw)
type: enumeration
description:
HA key used to encrypt & authenticate HA messages betwen
the peers. This is provided in clear-text by the client &
expected to be hashed by the firewall in the configuration
nodetype: leaf (rw)
type: string
description:
HA key,used to encrypt & authenticate HA messages between
the peers, supplied as a hashed value using the notation
described in the definition of the crypt-password-type
nodetype: leaf (rw)
type: oc-aaa-types:crypt-password-type
description:
When set to true all traffic between firewall units in a HA
cluster are encrypted. If operator provided encryption key is
supported, that value must be derived from the
ha-key/ha-key-hashed leaf nodes. If that is not supported, the
vendor is expected to derive it's own keying material
nodetype: leaf (rw)
type: boolean
default: false
description:
The high availbility group id for a unit. This value MUST
match across both units participating in a HA cluster
nodetype: leaf (rw)
type: uint8
description:
Specify the device-id to identify the firewall within a HA
group. This value MUST be unique to the local-unit and MUST
NOT clash with the peer within a ha-group
nodetype: leaf (rw)
type: uint8
description:
When set to true the firewall forces reelection of the active
role after joining the cluster
nodetype: leaf (rw)
type: boolean
default: false
description:
Set priority value for the firewall. This value is used
to participate in the election of the active unit in the HA
cluster. Firewall with highest priority is elected as the
ACTIVE unit
nodetype: leaf (rw)
type: uint8
description:
Length of time, from the last received Hello message,
a firewall will wait before taking over the active role in a
HA pair
nodetype: leaf (rw)
type: uint32
units: milliseconds
description:
Interval between hello messages exchanged by the HA peers
nodetype: leaf (rw)
type: uint32
units: milliseconds
description:
Global health values associated with the interface monitoring
state machine
nodetype: leaf (rw)
type: enumeration
description:
State container for HA parameters
nodetype: container (ro)
description:
This must be set to 'true' to initiate firewall participation
in a HA cluster. Once set to 'true', this boolean can be
flipped to 'false' to DISABLE HA and put a unit in a
'suspended' state while retaining all other HA settings &
configuration parameters. At the same time the 'ha-state' leaf
under 'ha-parameters-state' must then be updated to
'SUSPENDED'
nodetype: leaf (ro)
type: boolean
default: false
description:
Configurable HA modes
nodetype: leaf (ro)
type: enumeration
description:
HA key used to encrypt & authenticate HA messages betwen
the peers. This is provided in clear-text by the client &
expected to be hashed by the firewall in the configuration
nodetype: leaf (ro)
type: string
description:
HA key,used to encrypt & authenticate HA messages between
the peers, supplied as a hashed value using the notation
described in the definition of the crypt-password-type
nodetype: leaf (ro)
type: oc-aaa-types:crypt-password-type
description:
When set to true all traffic between firewall units in a HA
cluster are encrypted. If operator provided encryption key is
supported, that value must be derived from the
ha-key/ha-key-hashed leaf nodes. If that is not supported, the
vendor is expected to derive it's own keying material
nodetype: leaf (ro)
type: boolean
default: false
description:
The high availbility group id for a unit. This value MUST
match across both units participating in a HA cluster
nodetype: leaf (ro)
type: uint8
description:
Specify the device-id to identify the firewall within a HA
group. This value MUST be unique to the local-unit and MUST
NOT clash with the peer within a ha-group
nodetype: leaf (ro)
type: uint8
description:
When set to true the firewall forces reelection of the active
role after joining the cluster
nodetype: leaf (ro)
type: boolean
default: false
description:
Set priority value for the firewall. This value is used
to participate in the election of the active unit in the HA
cluster. Firewall with highest priority is elected as the
ACTIVE unit
nodetype: leaf (ro)
type: uint8
description:
Length of time, from the last received Hello message,
a firewall will wait before taking over the active role in a
HA pair
nodetype: leaf (ro)
type: uint32
units: milliseconds
description:
Interval between hello messages exchanged by the HA peers
nodetype: leaf (ro)
type: uint32
units: milliseconds
description:
Global health values associated with the interface monitoring
state machine
nodetype: leaf (ro)
type: enumeration
description:
Firewall's operational ha-state
nodetype: leaf (ro)
type: enumeration
description:
Reports the time the firewall entered its current HA
operational state. The value is the timestamp in nanoseconds
relative to the Unix Epoch (Jan 1, 1970 00:00:00 UTC).
nodetype: leaf (ro)
type: oc-types:timeticks64
units: nanoseconds
description:
Returns 'TRUE' if config sync is operational between HA
peers. Returns 'FALSE' otherwise.
nodetype: leaf (ro)
type: boolean
description:
Returns 'TRUE' if session sync is operational between HA
peers. Returns 'FALSE' otherwise.
nodetype: leaf (ro)
type: boolean
description:
List of HA parameters that are mismatched between peers. Use
this list to highlight root cause of HA operational issues
that an operator must fix
nodetype: leaf-list (ro)
type: identityref
description:
Global interface monitoring status
nodetype: leaf (ro)
type: enumeration
description:
Top-level container for HA control link
nodetype: container (rw)
description:
Configuration parameters related to primary HA control
link
nodetype: container (rw)
description:
Specify which interface will be used to exchange HA control
messages between peers
nodetype: leaf (rw)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange control
messages
nodetype: leaf (rw)
type: oc-inet:port-number
description:
Specify the ipv4 address used by the fw for the control link
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If peer control ipv4 is in a different subnet, specify the
gateway ipv4 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv4-address
description:
Specify the ipv6 address used by the fw for the control link
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
If peer control ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv6-address
description:
Specify the peer ipv4 address, if control link is utilizing
Layer 3
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
Specify the peer ipv6 address, if control link is utilizing
Layer 3
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
Operational state data related to primary HA control link
nodetype: container (ro)
description:
Specify which interface will be used to exchange HA control
messages between peers
nodetype: leaf (ro)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange control
messages
nodetype: leaf (ro)
type: oc-inet:port-number
description:
Specify the ipv4 address used by the fw for the control link
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If peer control ipv4 is in a different subnet, specify the
gateway ipv4 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv4-address
description:
Specify the ipv6 address used by the fw for the control link
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
If peer control ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv6-address
description:
Specify the peer ipv4 address, if control link is utilizing
Layer 3
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
Specify the peer ipv6 address, if control link is utilizing
Layer 3
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
Data related to backup HA control link
nodetype: container (rw)
description:
Configuration data related to backup HA control link
nodetype: container (rw)
description:
Specify which interface will be used to exchange HA control
messages between peers
nodetype: leaf (rw)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange control
messages
nodetype: leaf (rw)
type: oc-inet:port-number
description:
Specify the ipv4 address used by the fw for the control link
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If peer control ipv4 is in a different subnet, specify the
gateway ipv4 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv4-address
description:
Specify the ipv6 address used by the fw for the control link
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
If peer control ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv6-address
description:
Specify the peer ipv4 address, if control link is utilizing
Layer 3
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
Specify the peer ipv6 address, if control link is utilizing
Layer 3
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
Operational state data related to backup HA control link
nodetype: container (ro)
description:
Specify which interface will be used to exchange HA control
messages between peers
nodetype: leaf (ro)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange control
messages
nodetype: leaf (ro)
type: oc-inet:port-number
description:
Specify the ipv4 address used by the fw for the control link
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If peer control ipv4 is in a different subnet, specify the
gateway ipv4 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv4-address
description:
Specify the ipv6 address used by the fw for the control link
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
If peer control ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv6-address
description:
Specify the peer ipv4 address, if control link is utilizing
Layer 3
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
Specify the peer ipv6 address, if control link is utilizing
Layer 3
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
Top-level container for HA data link
nodetype: container (rw)
description:
Configuration parameters related to primary HA data link
nodetype: container (rw)
description:
Specify which interface will be used to sync session tables,
forwarding tables, ARP tables, IPSEC SAs and any other
messages that MUST be exchanged to facilitate seamless traffic
handling during a failover event
nodetype: leaf (rw)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange data link
messages
nodetype: leaf (rw)
type: oc-inet:port-number
description:
If data link is layer 3, specify the local unit's ipv4
address
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If peer data ip is in a different subnet, specify the gateway
ip here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv4-address
description:
If data link is layer 3, specify the local unit's ipv6
address
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
If peer data ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv6-address
description:
If data link is layer 3, specify the peer's ipv4 address
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If data link is layer 3, specify the peer's ipv6 address
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
Operational state parameters related to primary HA data
link
nodetype: container (ro)
description:
Specify which interface will be used to sync session tables,
forwarding tables, ARP tables, IPSEC SAs and any other
messages that MUST be exchanged to facilitate seamless traffic
handling during a failover event
nodetype: leaf (ro)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange data link
messages
nodetype: leaf (ro)
type: oc-inet:port-number
description:
If data link is layer 3, specify the local unit's ipv4
address
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If peer data ip is in a different subnet, specify the gateway
ip here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv4-address
description:
If data link is layer 3, specify the local unit's ipv6
address
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
If peer data ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv6-address
description:
If data link is layer 3, specify the peer's ipv4 address
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If data link is layer 3, specify the peer's ipv6 address
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
Parameters related to backup HA data link
nodetype: container (rw)
description:
Configuration parameters related to backup HA data link
nodetype: container (rw)
description:
Specify which interface will be used to sync session tables,
forwarding tables, ARP tables, IPSEC SAs and any other
messages that MUST be exchanged to facilitate seamless traffic
handling during a failover event
nodetype: leaf (rw)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange data link
messages
nodetype: leaf (rw)
type: oc-inet:port-number
description:
If data link is layer 3, specify the local unit's ipv4
address
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If peer data ip is in a different subnet, specify the gateway
ip here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv4-address
description:
If data link is layer 3, specify the local unit's ipv6
address
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
If peer data ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (rw)
type: oc-inet:ipv6-address
description:
If data link is layer 3, specify the peer's ipv4 address
nodetype: leaf (rw)
type: oc-inet:ipv4-prefix
description:
If data link is layer 3, specify the peer's ipv6 address
nodetype: leaf (rw)
type: oc-inet:ipv6-prefix
description:
Operational state parameters related to backup HA data
link
nodetype: container (ro)
description:
Specify which interface will be used to sync session tables,
forwarding tables, ARP tables, IPSEC SAs and any other
messages that MUST be exchanged to facilitate seamless traffic
handling during a failover event
nodetype: leaf (ro)
type: oc-if:base-interface-ref
description:
Specify which TCP/UDP port will be used to exchange data link
messages
nodetype: leaf (ro)
type: oc-inet:port-number
description:
If data link is layer 3, specify the local unit's ipv4
address
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If peer data ip is in a different subnet, specify the gateway
ip here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv4-address
description:
If data link is layer 3, specify the local unit's ipv6
address
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
If peer data ipv6 is in a different subnet, specify the
gateway ipv6 here to provide reachability
nodetype: leaf (ro)
type: oc-inet:ipv6-address
description:
If data link is layer 3, specify the peer's ipv4 address
nodetype: leaf (ro)
type: oc-inet:ipv4-prefix
description:
If data link is layer 3, specify the peer's ipv6 address
nodetype: leaf (ro)
type: oc-inet:ipv6-prefix
description:
Top level container for monitored interface groups
nodetype: container (rw)
description:
List of interface groups being monitored
nodetype: list (rw)
list keys: [id]
description:
Reference to the interface-group key used to bundle
interfaces in a logical group
nodetype: leaf (list key) (rw)
type: leafref
description:
Configuration parameters for the interface-groups
nodetype: container (rw)
description:
Assign a unique id to an interface group
nodetype: leaf (rw)
type: union
type: uint8
type: string
description:
Interface being monitored
nodetype: leaf-list (rw)
type: oc-if:base-interface-ref
description:
Determines how the State of monitored-interfaces is used to
determine the State of the group they are a member of
nodetype: leaf (rw)
type: enumeration
description:
State container for monitored interface-groups.
nodetype: container (ro)
description:
Assign a unique id to an interface group
nodetype: leaf (ro)
type: union
type: uint8
type: string
description:
Interface being monitored
nodetype: leaf-list (ro)
type: oc-if:base-interface-ref
description:
Determines how the State of monitored-interfaces is used to
determine the State of the group they are a member of
nodetype: leaf (ro)
type: enumeration
description:
The status of this interface group
nodetype: leaf (ro)
type: enumeration
This model defines interface groups and corresponding monitoring policies for firewall HA groups. It also provides modeling for a global health monitoring policy for the HA group.
openconfig-extensions
openconfig-interfaces