High Availability and Link Reliability (HRP, VRRP, dual-system hot standby)
This domain tests HRP, VRRP, and dual-system hot standby on USG pairs. Questions often ask what is synchronized and why failover breaks an existing session.
Core rules
- HRP synchronizes configuration, session tables, ARP, and dynamic entries between peers; it requires a heartbeat link and matching software and hardware.
- VRRP provides a virtual IP and gateway; priority and preemption determine the master.
- Dual-system hot standby can be active/standby or load-balancing; active/standby keeps one device ready to take over.
- HRP track monitors uplinks or interfaces and lowers priority or triggers switchover.
- Stateful failover preserves existing sessions; without session synchronization, clients must reconnect.
Worked example
Two USGs protect an outbound link. Configure VRRP on the Trust and Untrust interfaces with a virtual IP, enable HRP, and track the uplink. Reasoning: VRRP gives hosts a resilient gateway; HRP mirrors sessions and configuration; tracking detects a dead uplink before hosts notice. Verify HRP state and that session synchronization is enabled.
Traps that cost marks
- Different software versions on HRP peers.
- Forgetting to enable session synchronization.
- Split-brain from a broken heartbeat link.
- VRRP preemption causing flapping.