Networking topology, high availability, and deployment modes
What this domain tests
This domain covers how ADC nodes are placed in the network and how they achieve high availability. Questions target HA pair behavior, failover triggers, synchronization, INC mode, and cluster versus HA deployment choices.
HA and topology rules
- A standard HA pair is active-passive: one node is primary and handles traffic; the secondary monitors the primary and takes over on failover.
- Each node keeps a unique NSIP. The VIPs and SNIPs are shared and move with the active role. The pair synchronizes configuration, certificates, and some runtime state.
- Failover can be triggered by heartbeat loss, interface failure, or a monitored entity. Forced failover and graceful shutdown are administrative actions. Stay-primary and failover-control settings change behavior.
- INC (Independent Network Configuration) mode lets each node use different subnet masks, gateways, and SNIPs-useful when nodes are in different subnets. It is not the default and requires planning.
- Cluster deployments scale beyond two nodes and use a cluster IP and node IDs; they are not the same as an HA pair.
- One-arm topology places the ADC on the same VLAN as servers; two-arm separates client and server sides. Inline transparent mode can avoid re-addressing but limits some features.
Worked example
An HA pair loses the primary. The secondary takes over, but users report the VIP is unreachable for about a minute, then recovers. The engineer finds the switch still has the old MAC address for the VIP. Reasoning: when the secondary becomes active, it sends gratuitous ARP for the VIP, and upstream devices relearn the MAC. A delay from stale ARP or from switch port security can explain the outage. If the nodes are in different subnets, standard HA may not work; INC mode is needed so each node has a local gateway and SNIP, and the VIP behavior must be designed accordingly.
Traps that cost marks
HA does not load-balance traffic between the two nodes by default. A service being DOWN does not necessarily force an HA failover unless HA monitoring is configured for it. Both nodes must run compatible firmware and have synchronized configuration; a forced sync is not the same as a failover. Do not configure the same NSIP on both nodes.