Virtual Wire Support of High Availability
Virtual wires support active/passive and active/active
HA and path monitoring. You can speed up HA failover for an active/passive
HA pair by pre-negotiating LACP and LLDP.
If you configure the firewall to perform path monitoring
for
High Availability using
a virtual wire path group, the firewall attempts to resolve ARP
for the configured destination IP address by sending ARP packets
out both of the virtual wire interfaces. The destination IP address
that you are monitoring must be on the same subnetwork as one of
the devices surrounding the virtual wire.
Virtual wire interfaces support both active/passive and active/active
HA. For an active/active HA deployment with a virtual wire, the
scanned packets must be returned to the receiving firewall to preserve
the forwarding path. Therefore, if a firewall receives a packet
that belongs to the session that the peer HA firewall owns, it sends
the packet across the HA3 link to the peer.
You can configure the passive firewall in an HA pair to allow
peer devices on either side of the firewall to pre-negotiate LLDP and
LACP over a virtual wire before an HA failover occurs. Such a configuration
for
LACP and LLDP Pre-Negotiation
for Active/Passive HA speeds up HA failovers.