Introduction to HA

HA, the abbreviation for High Availability, provides a failover solution for communications line or device failure to ensure the smooth communication and effectively improve the reliability of the network. To implement the HA function, you need to configure the two security devices as HA clusters, using the identical hardware platform, firmware version, both enabling VR and AV functions, with anti-virus license installed. When one device is not available or can not handle the request from the client properly, the request will be promptly directed to the other device that works normally, thus ensuring uninterrupted network communication and greatly improving the reliability of communications.

Security devices support two HA modes: Active-Passive (A/P) and Active-Active (A/A).

• Active-Passive (A/P) mode: In the HA cluster, configure two devices to form a HA group, with one device acting as a primary device and the other acting as its backup device. The primary device is active, forwarding packets, and meanwhile synchronizes all of its network and configuration information and current session information to the backup device. When the primary device fails, the backup device will be promoted to primary and takes over its work to forward packets. This A/P mode is redundant, and features a simple network structure for you to maintain and manage.
• Active-Active (A/A) mode: When the security device is in NAT mode, routing mode or a combination of both, you can configure two security devices in the HA cluster as active, so that the two devices are running their own tasks simultaneously, and monitoring the operation status of each other. When one device fails, the other will take over the work of the failure device and also run its own tasks simultaneously to ensure uninterrupted work. This mode is known as the Active-Active mode. The A/A mode has the advantage of high-performance, as well as load-balancing.

HA Cluster

For the external network devices, a HA cluster is a single device which handles network traffic and provides security services. The HA cluster is identified by its cluster ID. After specifying a HA cluster ID for the device, the device will be in the HA state to implement HA function.

HA Group

System will select the primary and backup device of the same HA group ID in a HA cluster according to the HCMP protocol and the HA configuration. The primary device is in active state and processes network traffic. When the primary device fails, the backup device will take over its work.

When assigning a cluster ID to the device, the HA group with ID 0 will be automatically created. In Active-Passive (A/P) mode, the device only has HA group 0. In Active-Active (A/A) mode, the latest system version supports two HA groups, i.e., Group 0 and Group 1.

Virtual Forward Interface and MAC

In the HA environment, each HA group has an interface to forward traffic, which is known as Virtual Forward Interface. The primary device of each HA group manages a virtual MAC (VMAC) address which is corresponding with its interface, and the traffic is forwarded on the interface. Different HA groups in a HA cluster cannot forward data among each other. VMAC address is defined by HA cluster ID, HA group ID and the physical interface index.

HA Selection

In a HA cluster, if the group ID of the HA devices is the same, the one with higher priority will be selected as the primary device.

HA Synchronization

To ensure the backup device can take over the work of the primary device when it fails, the primary device will synchronize its information with the backup device. There are three types of information that can be synchronized: configuration information, files and RDO (Runtime Dynamic Object). The specific content of RDO includes:

• Session information (The following types of session information will not be synchronized: the session to the device itself, tunnel session, deny session, ICMP session, and the tentative session)
• IPSec VPN information
• SCVPN information
• DNS cache mappings
• ARP table
• PKI information
• DHCP information
• MAC table
• WebAuth information

System supports two methods to synchronize: real-time synchronization and batch synchronization. When the primary device has just been selected successfully, the batch synchronization will be used to synchronize all information of the primary device to the backup device. When the configurations change, the real-time synchronization will be used to synchronize the changed information to the backup device. Except for the HA related configurations and local configurations (for example, the host name), all the other configurations will be synchronized.