Firewall HA Pairs: Active-Passive Failover Explained

Active-passive failover ensures that a backup firewall takes over seamlessly if the primary one fails, minimizing downtime. This setup is crucial because firewalls are critical points in network infrastructure.

Overview

The problem is clear: a single firewall can be a single point of failure. If it goes down, everything stops working. Active-passive failover pairs two identical firewalls so that only one handles traffic at any given time, while the other stands by to take over quickly if needed. The typical configuration involves:

• Unit A forwards all traffic.
• Unit B holds an identical configuration and monitors Unit A's heartbeat.

If Unit A fails, Unit B takes over within 1-10 seconds, ensuring minimal disruption to network operations.

Key Components of Failover

Floating IP Addresses

The gateway IP address (and public IPs) are shared by the pair. The active unit responds to these addresses. LAN devices will notice a change in the MAC address owner via gratuitous ARP announcements. Protocols used for this include VRRP and vendor equivalents like FortiGate's FGCP.

Configuration Synchronization

Firewall policies, objects, and virtual IPs (VIPs) are replicated automatically between both units. This means you manage the pair as a single entity. Directly configuring the standby unit is not recommended to maintain consistency.

Session Synchronization

The state table, which tracks active connections, replicates continuously. This ensures that established sessions survive failover, preventing connection resets and ensuring seamless user experience. For Opnsense, this involves enabling PFSYNC; for FortiGate, it's the session-pickup enable setting.

Monitored Interfaces

These interfaces allow the backup firewall to take over if a monitored link fails. Configuration includes settings like "if my WAN or LAN link dies, I should fail over even though I'm otherwise alive." Link monitors help ensure that failover triggers on cable pulls rather than just box death.

Failure Modes and Mitigation

Split Brain

This occurs when the heartbeat link between the firewalls fails, causing both units to think they are active. They will both claim the floating IP address, leading to chaos. To mitigate this:

• Use dedicated or redundant heartbeat links.
• Avoid using switches that could fail with everything else.

Asymmetric Upgrades and Untested HA

Mismatches in firmware versions can break synchronization. Regularly testing the failover process by pulling power from the active unit during calm windows helps ensure reliability.

Homelab Considerations

While two firewalls on hobby hardware is an enterprise-level practice, it's worth setting up once to learn how HA works. For most home setups, a cold spare with the configuration backed up can cover common failure scenarios effectively and is more cost-effective.

By understanding these components, you can ensure your network remains highly available even if one firewall fails.