topic Re: Whys is Passive peer still passing traffic? in General Topics

Whys is Passive peer still passing traffic?

MarioMarquez — Wed, 04 Mar 2020 16:28:50 GMT

When I go to Monitor > Session Browser I still see active connections on the pasive peer. I verified it is truly the passive firewall and the other is active and that its supposed to be in Active/Passive mode in the HA configuration. Running the show session all command reveals the same thing. All time stamps are current.

Re: Whys is Passive peer still passing traffic?

Mick_Ball — Wed, 04 Mar 2020 16:35:17 GMT

so that if/when the firewalls fail over, the sessions are continued.

the traffic/session info is replicated over the HA link.

Just check the network interfaces of the passive. they will be down. (Red)

Re: Whys is Passive peer still passing traffic?

atluri4b8 — Mon, 09 Mar 2020 16:08:22 GMT

@MarioMarquez, the passive firewall is not exactly passing the traffic. You can still see the active connections only because of the session synchronization between the HA pair firewalls.

In the active/passive configuration, you can find all other sessions except for ICMP sessions if you observe keenly.
In the active/active configuration, ICMP, Host sessions & Multicast sessions are not synchronized.

This session synchronization helps in avoiding any loss of service, in case of any hardware/software disruption occurs.

Hope this helps.