The cluster configuration is a mostly automatic process, but there are some details, during the configuration, you must pay attention to.
Pre-configuration
Before running the cluster wizard, you have to set up your environment by following the below steps.
Secondary node deploy
First of all you need to deploy the secondary node of the cluster (the primary one will be the already existing one). To deploy the secondary node you can follow the Appliance deploy guide.
Firewall configuration
When the secondary node is deployed, you need to configure your firewall to allow the traffic from and to the Required Ports.
Note: you can easily test your firewall configuration using the on-board Check Firewall Ports tool from the appliance web interface.
DNS configurations
You need to perform the following operations on your DNS:
- create the A record to make the appliance FQDN pointing to the IP address of the just deployed secondary node
- update the SPF (TXT) record of all domains that will use the secondary node to send email, with the secondary node IP address
- create the PTR record on the name server where the zone of the network is. The PTR record must point to the appliance FQDN
Configuration
You are ready to perform the cluster configuration. To begin this process you have to reach the Cluster Wizard page on both nodes.
First of all you have to take note of both appliance IP address and Public Keys. If multiple addresses are displayed, you have to choose the one which is visible by the other node.
Note: if any NAT is in place, you should set the IP address visible from the other appliance network.
- Paste the secondary node Public Key into the first node Public Key field and vice versa.
- Paste the secondary node IP address into the first node Connection IP field and vice versa.
- Click on the Next green button.
- Wait for the cluster firewall checks.
- When the cluster firewall checks complete, you can choose which node will be the primary and which one the secondary.
Primary node: click Replicate this node button on the node you want the configuration will be replicated on the other.
Secondary node: click Overwrite this node button on the other node.
- Wait for the cluster wizard to complete, you can check the procedure progress from the Primary node.
- The cluster wizard has been completed
Post-configuration
The cluster is now correctly set up, but the secondary node TLS certificate is overwritten with the primary node one. All you need to do is to generate a new certificate.
As you can see, the browser blocks the connection to the secondary node web interface, as the common name of the certificate doesn't match the appliance FQDN.
Note: if you are using Google Chrome you can bypass this blocking alert by typing thisisunsafe word in the alert page.
From the TLS Certificates page click on the New button from the table toolbar to generate a new TLS certificate.
When the certificate has been generated, select and apply it to both Mail Transport Agent and Administrative Web Interface.