High Availability and Clustering
HA models
HA pairs use a control link (HA1) for hellos and configuration sync, a data link (HA2) for session sync, and optionally HA3 for backups. Active/passive is simplest; active/active requires careful routing and can create asymmetric flows. Clustering adds quorum and master election.
Failover mechanics
The active device sends heartbeats; missed heartbeats trigger failover. Link and path monitoring detect uplink failures; without them the firewall stays active while the network is down. Floating/virtual IPs move via gratuitous ARP. Session sync keeps established TCP sessions alive, but UDP and some application sessions may reset. Preemption returns control to the preferred device after recovery.
Traps
Preemption causing flapping, mismatched software or licenses, HA interfaces in the same subnet as data, and forgotten path monitoring. Split-brain occurs when the control link fails but both units remain active.
Rule of thumb
Enable path monitoring on uplinks, disable preemption unless a deterministic primary is required, and verify configuration sync before every upgrade.
Worked example
After a failover, users lose long-lived sessions but new sessions work: session sync was disabled or partial. Enable session pickup and confirm HA2 link health.