Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/index.html?contextId=HA-configuration-virtual-hosts

Additional configuration for virtual hosts

When running a virtual HA cluster, additional configuration of the hypervisor is required.

VMWare ESXi

When using ESXi, change the port group security settings, MAC address changes and Forged transmit to Accept. You can do this either at the vSwitch or port group level. If you configure this on the vSwitch, the port group settings must inherit the settings from the vSwitch.

Here's an example of the changes at the vSwitch level.

vSwitch level settings.

Here's an example of the port group settings if you configure MAC address changes and Forged transmit on the vSwitch.

Port group settings when configuration is done on vSwitch.

Here's an example of the MAC address changes and Forged transmit settings if you configure them only at the port group level.

Port group settings when no changes are made at the vSwitch level.

HyperV

If you use HyperV, you must turn on Enable MAC address spoofing on all network adapters of the Sophos Firewall HA virtual machine, except the network adapter used for the dedicated HA link. Do as follows:

  1. Go to Advanced features.
  2. Click Enable MAC address spoofing.

Here's an example of where you must turn on MAC address spoofing.

Enable MAC address spoofing in HyperV.