up vote 0 down vote favorite
share [g+] share [fb]

We have two physical servers on the different area protected by firewalls. We want to build Hyper-V cluster for this servers. We found the article from Microsoft VMM Ports and Protocols, but there are a lot of different notes which says that this article is wrong (for example this one). Does anybody exactly know which ports do we need to open?

link|improve this question
62% accept rate
A cluster through a firewall? – pauska Jun 22 '11 at 7:14
Yes. This servers are located on different area protected by firewalls. – Sasha Jun 22 '11 at 7:18
2  
That usually requires several clusters. I've never heard about anyone using a cluster through a firewall. I'm pretty sure that every support matrix out there will tell you not to.. – pauska Jun 22 '11 at 7:25
In our case we cannot remove firewall from the scheme... And the main idea was to create cluster using two servers on the different areas. – Sasha Jun 22 '11 at 7:43
7  
@Sasha, couldnt' agree with Pauska more here, bad idea, really bad - I do geographically-disperse clustering but over private/dark-fibre links with nothing above Layer 1 between them - this works but building it like this WILL break quite frequently. – Chopper3 Jun 22 '11 at 8:46
show 3 more comments
feedback

3 Answers

up vote 0 down vote

I really don't think this is possible unless you have considerable (resilient) bandwidth between your sites. It's certainly more complicated than just opening up a few firewall ports. Have a look at this presentation that will give you some idea of the requirements then boggle at the budget required.

link|improve this answer
feedback
up vote 0 down vote

If you must go down this path, have a look here for a third party tool that may get the job done for you:

http://www.visionsolutions.com/Products/DT-Avail.aspx

link|improve this answer
As I can understand we will spent less money for DT Availability product then building hardware storage for this two servers? – Sasha Jun 28 '11 at 18:29
Umm... I don't know, will you? – joeqwerty Jun 28 '11 at 19:30
~9600 for DT Product licenses VS hardware storage... I think software win! – Sasha Jun 28 '11 at 20:46
On a side note, the last time I purchased DT they were very open to discounts for multiple license purchases. – joeqwerty Jun 28 '11 at 22:51
feedback
up vote 0 down vote

The core of the problem is that I believe the MS Clustering heartbeat is not a TCP/IP protocol packet, rather an ethernet broadcast of a specific kind. This means that cluster nodes need to be in the same subnet, and your firewall will be a firewall-on-a-bridge rather than a firewall-on-a-router. Because of this, a TCP/IP oriented firewall will not know what to do with this kind of packet and will in all likelihood, drop it.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.