HA Pair Fails Over During Peak, Clients Suffer
A pair of Mobility Controllers is configured as an active-standby HA pair using VRRP for the controller IP. During a peak-hour test, the active controller was rebooted. Clients on tunneled WLANs lost connectivity for about 90 seconds and many did not reconnect until they re-associated manually. The standby did take over the controller IP. Investigation shows the HA heartbeat traverses the same single 1 Gb uplink used for client traffic, and the two controllers are in different buildings connected by one fiber pair. The customer requires sub-15-second failover with no client re-authentication.
1. Explain the gap between the observed 90-second outage and the customer's sub-15-second requirement, and identify the design flaws.
Read the worked answer
VRRP only moves the controller IP; it does not preserve client state or tunnel sessions by itself. The 90-second gap indicates the standby was not maintaining synchronized client/tunnel state, so on failover clients had to rebuild sessions. Likely contributors:
- Heartbeat on the data path: sharing the single 1 Gb uplink means a link event takes down both data and heartbeat simultaneously, delaying detection and forcing a full re-converge.
- No dedicated HA/state-sync link: without a dedicated, low-latency path, state synchronization is slow or incomplete.
- Single fiber between buildings: no path redundancy for the sync/heartbeat.
To meet sub-15-second failover with no re-auth, the design needs a proper HA configuration with a dedicated heartbeat/state-sync path, symmetric and redundant connectivity, and verified stateful synchronization so the standby can assume sessions without forcing clients to re-associate.
2. What verification steps would prove the HA pair meets the no-re-auth requirement before cutover?
Read the worked answer
Run a controlled failover test and measure:
- Failover time - timestamp the active reboot and the moment the standby answers the controller IP; must be under 15 s.
- Session preservation - capture client association/authentication events during failover; a compliant design shows no new 802.1X/EAP exchange and no DHCP renew.
- Tunnel continuity - confirm tunneled client traffic resumes without a new tunnel build.
- Heartbeat path - verify the dedicated sync link is up and that a data-uplink failure does not take the heartbeat down.
- Repeat both directions (A→B and B→A) and under load, since state sync under peak load is the real test. Document results and only then declare the requirement met.