High Availability, Redundancy, and Failover
This domain covers the active-passive HA pair: synchronization, failover triggers, and recovery. Exam questions focus on what is synchronized, what causes a node to take over, and how to diagnose a pair that is out of sync or split-brained.
Core rules
- An HA pair has one primary and one secondary node. Each node has its own NSIP; shared VIPs move to the active node on failover.
- Nodes exchange heartbeats and synchronize configuration and files. Configuration commands entered on the primary are propagated to the secondary when propagation is enabled.
- Failover can occur when heartbeats are lost or a monitored interface fails. Administrators can also issue a forced failover.
- Force sync reconciles configuration between nodes; sync ha files synchronizes files. Show ha node displays the current state and synchronization status.
- INC mode allows each node to have independent network configuration, which is useful when the pair spans different subnets.
Worked example
The HA heartbeat VLAN fails, but the data VLANs remain healthy. The secondary stops receiving heartbeats and takes over after the dead interval. If the heartbeat path is broken in both directions, each node may believe it should be primary, creating a split-brain condition. The fix is to restore a redundant heartbeat path, verify state with show ha node, and run a force sync after connectivity returns. The reasoning is that HA health depends on the heartbeat path, not on whether user traffic still flows.
Traps that cost marks
Mismatched software versions or licenses are not supported in an HA pair. Disabling propagation leaves the secondary with stale configuration. Heartbeat traffic on a busy data VLAN can be delayed or lost. After failover, gratuitous ARP updates the network, so upstream ARP caching should not be blamed first. Force sync is not a failover command. A node configured to stay primary can prevent the expected takeover. Always check both nodes when troubleshooting HA, because logs and states may differ.
Design checks
Use redundant heartbeat links where possible, keep HA interfaces consistent, and confirm that both nodes can reach the same management and authentication services. After any major change, verify synchronization before assuming the pair is protected.