Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have two physical servers on the different area protected by firewalls. We want to build Hyper-V cluster for this servers. We found the article from Microsoft VMM Ports and Protocols, but there are a lot of different notes which says that this article is wrong (for example this one). Does anybody exactly know which ports do we need to open?

share|improve this question
A cluster through a firewall? – pauska Jun 22 '11 at 7:14
Yes. This servers are located on different area protected by firewalls. – Sasha Jun 22 '11 at 7:18
That usually requires several clusters. I've never heard about anyone using a cluster through a firewall. I'm pretty sure that every support matrix out there will tell you not to.. – pauska Jun 22 '11 at 7:25
In our case we cannot remove firewall from the scheme... And the main idea was to create cluster using two servers on the different areas. – Sasha Jun 22 '11 at 7:43
@Sasha, couldnt' agree with Pauska more here, bad idea, really bad - I do geographically-disperse clustering but over private/dark-fibre links with nothing above Layer 1 between them - this works but building it like this WILL break quite frequently. – Chopper3 Jun 22 '11 at 8:46

If you must go down this path, have a look here for a third party tool that may get the job done for you:

share|improve this answer
As I can understand we will spent less money for DT Availability product then building hardware storage for this two servers? – Sasha Jun 28 '11 at 18:29
Umm... I don't know, will you? – joeqwerty Jun 28 '11 at 19:30
~9600 for DT Product licenses VS hardware storage... I think software win! – Sasha Jun 28 '11 at 20:46
On a side note, the last time I purchased DT they were very open to discounts for multiple license purchases. – joeqwerty Jun 28 '11 at 22:51

The core of the problem is that I believe the MS Clustering heartbeat is not a TCP/IP protocol packet, rather an ethernet broadcast of a specific kind. This means that cluster nodes need to be in the same subnet, and your firewall will be a firewall-on-a-bridge rather than a firewall-on-a-router. Because of this, a TCP/IP oriented firewall will not know what to do with this kind of packet and will in all likelihood, drop it.

share|improve this answer

I really don't think this is possible unless you have considerable (resilient) bandwidth between your sites. It's certainly more complicated than just opening up a few firewall ports. Have a look at this presentation that will give you some idea of the requirements then boggle at the budget required.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.