Ha failover for A/A firewall

[vikramadityak]

Hello All,

We have a setup of Active/Active firewall running with eBGP towards  router 1 and router 2 respectively  and static route for  Lan segment (subnet 1 and 2).

eBGP with As-path prepend for subnet 2 at firewall 1 and As-path prepend for subnet 1 at firewall 2

Static route from subnet 1 to hsrp ip  and static route for subnet 2 to hsrp ip. and static route at PA firewall for subnet 1 and subnet 2 to hsrp ip.

We have two different subnet which is pointing to  subnet 1 with Active primary Firewall and  subnet 2 with Active Secondary firewall .

Note:-we also need symmetric path .

What will happen if primary active firewall fail ?

1. Is active session drop or continue through active secondary firewall ?

Please provide inputs for failover.

Thanks in advance community.

[ozheng]

Hello @vikramadityak ,

From your diagram, I would say :

- the firewall A falls, the firewall B is already active, so not a big difference except the traffic load may increase on the node.

- the BGP will notice the peering down (depend on your BGP reactivity).

- depend on the configuration of the static route

--> the sessions are in sync between A and B, so existing sessions would be affected if your static routes / BGP routes did not removed at firewall A failure.

Olivier