Additional configuration for virtual hosts
When running a virtual HA cluster, additional configuration of the hypervisor is required.
When using ESXi, change the port group security settings, MAC address changes and Forged transmit to Accept. You can do this either at the vSwitch or port group level. If you configure this on the vSwitch, the port group settings must inherit the settings from the vSwitch.
Here's an example of the changes at the vSwitch level.
Here's an example of the port group settings if you configure MAC address changes and Forged transmit on the vSwitch.
Here's an example of the MAC address changes and Forged transmit settings if you configure them only at the port group level.
If you use HyperV, you must turn on Enable MAC address spoofing on all network adapters of the Sophos Firewall HA virtual machine, except the network adapter used for the dedicated HA link. Do as follows:
- Go to Advanced features.
- Click Enable MAC address spoofing.
Here's an example of where you must turn on MAC address spoofing.