High Availability, Sync-Failover Device Groups, and Traffic Groups
Domain 5 - High Availability, Sync-Failover Device Groups, and Traffic Groups
This domain tests how a pair or cluster stays available and how configuration and floating addresses move between devices.
HA building blocks
Devices join a trust domain and a device group. A sync-failover device group controls configuration sync and failover; a sync-only group syncs configuration without failover. Traffic groups own floating self IPs and virtual servers. Each traffic group has a preferred active device and a failover order. Failover can use network failover heartbeats, hardwired failover, or both. Configuration sync is not automatic just because devices are in a group; you must sync or enable auto sync.
Rules
A floating self IP belongs to a traffic group and moves with it. MAC masquerade presents a shared MAC to reduce ARP churn. The active device for a traffic group answers ARP for its floating IPs. A standby device does not forward for that traffic group. For active/active, use multiple traffic groups with different preferred devices. NTP and identical software versions matter for stable sync.
Worked example
Two devices, BIG-A preferred for traffic-group 1 and BIG-B preferred for traffic-group 2. TG1 owns 10.10.10.100 and VS app1; TG2 owns 10.10.20.100 and VS app2. Normally BIG-A is active for app1 and BIG-B for app2. If BIG-A fails, TG1 fails over to BIG-B according to the failover order, and the floating self IP moves. BIG-B now carries both traffic groups. Configuration must have been synced beforehand, or BIG-B may lack the app1 objects.
Traps
- Assuming configuration sync happens continuously without auto sync.
- Confusing device group type: sync-failover versus sync-only.
- Thinking a traffic group is the same as a device group.
- Forgetting that a floating self IP must be in the traffic group that owns the virtual server.
- Ignoring failover order and preferred device settings.
- Overlooking NTP or version mismatch as a cause of unstable sync.