Ha failover for A/A firewall

V.Kumar296352 — Wed, 07 May 2025 08:54:07 GMT

Hello All,

We have a setup of Active/Active firewall running with eBGP towards router 1 and router 2 respectively and static route for Lan segment (subnet 1 and 2).

eBGP with As-path prepend for subnet 2 at firewall 1 and As-path prepend for subnet 1 at firewall 2

Static route from subnet 1 to hsrp ip and static route for subnet 2 to hsrp ip. and static route at PA firewall for subnet 1 and subnet 2 to hsrp ip.

We have two different subnet which is pointing to subnet 1 with Active primary Firewall and subnet 2 with Active Secondary firewall .

Note:-we also need symmetric path .

What will happen if primary active firewall fail ?

1. Is active session drop or continue through active secondary firewall ?

Please provide inputs for failover.

Thanks in advance community.

Re: Ha failover for A/A firewall

ozheng — Thu, 15 May 2025 04:21:01 GMT

Hello @V.Kumar296352 ,

From your diagram, I would say :

- the firewall A falls, the firewall B is already active, so not a big difference except the traffic load may increase on the node.

- the BGP will notice the peering down (depend on your BGP reactivity).

- depend on the configuration of the static route

--> the sessions are in sync between A and B, so existing sessions would be affected if your static routes / BGP routes did not removed at firewall A failure.

Olivier

topic Re: Ha failover for A/A firewall in Next-Generation Firewall Discussions

Ha failover for A/A firewall

Re: Ha failover for A/A firewall