Hey all, it's Jay from Sophos Support here.
We’ll discuss how we deploy High Availability, or HA, on Sophos firewalls in this two-part
video series.
In part one, we’ll discuss Sophos Firewall’s core HA functionality, architecture and the
all-important configuration steps required to prepare your firewalls for HA deployment.
The second video will cover the necessary steps for HA configuration.
Okay.
Let’s dive right in and look at the two HA modes Sophos Firewall has to offer:
active-active and active-passive.
We’ll discuss the difference between configurations, traffic flow in both modes, what event will
trigger failovers and the actual prerequisites required for a successful HA deployment.
Let's look at a typical High Availability Sophos Firewall network.
Both firewalls are configured with mirrored connections, minimizing single-point failures
while providing efficient, continuous access to any crucial applications or services.
The two modes that can be configured for High Availability are Active-Active or Active-Passive.
We'll discuss the pro’s and con’s of both HA modes later.
Suffice to say, Active-Active
HA pairs share the network load, whereas Active/-Passive HA pairs process all traffic on the primary
node, only failing over to the passive node on primary node failure.
Now, let's look at how packets are routed in Active-Active and Active-Passive HA implementations.
Irrespective of Active-Active or Active-Passive configuration, note that the primary device
first processes all packets because only the primary device responds to ARP requests via
its Virtual MAC address.
Quick note on that, Separate from the Sophos
Firewall's physical MAC addresses, the Virtual MAC address is assigned to and owned by the
Primary node and utilized by the HA cluster.
The Virtual MAC address will respond to ARP
requests and is assigned to each interface, except the dedicated HA link.
Back to our packet flow.
In this example, the client sends a packet
to the mail server.
The packet is then forwarded from Port B using SNAT to the destination.
The response is then received from the mail server on Port B, the WAN port, where the
response is forwarded from Port D to the client device.
However, in an Active-Active configuration, the auxiliary device processes the request.
The packet flow differs.
When the packet reaches the Primary device, it's sent to the Auxiliary
port in the corresponding direction, as seen here.
Whether you adopt Active-ACtive or Active-Passive HA configuration will depend on what you're
looking to achieve.
Some resilience and increased throughput with Active-Active or network resilience
in general with Active-Passive.
In an Active-Passive HA cluster, the primary
device will process all of the network traffic.
The auxiliary device participates in the cluster
but does not process any network traffic.
The auxiliary device remains in a standby
state until the primary device fails.
Then, the auxiliary device will become the primary
device and will process all of the network traffic.
However with Active-Active, both devices will process the network traffic.
All requests
will go to the primary device, which will do the load balancing and forward the traffic
to the auxiliary device for processing when needed.
If the primary device fails, the auxiliary
device will become the primary device and will process all of the network traffic.
One thing to note about Active-Active is that load balancing transfers connections to the
auxiliary device such as: Normal forwarded TCP Traffic
NATed, both SNAT & virtual host forwarded TCP traffic
And TCP traffic parsing proxy subsystems, such as a transparent proxy, direct proxy,
parent proxy and VLAN traffic.
Another thing to keep in mind is the common misconception that all traffic is load balanced
equally between firewalls, which isn't the case.
On top of that, an Active-Active HA
cluster will not load balance the following data types or packets: VPN, UDP, ICMP, multicast
or broadcast traffic.
Several events could trigger a failover, including but not limited to:
Mirrored port failure Device failure - power or power supply failure,
hardware or software failure You'll find an article in the video description
covering many events that can trigger a failover condition.
When planning an HA deployment, we must first ensure that we have prepared our environment
firewalls with the necessary prerequisites.
Please check out the articles in the video
description for a comprehensive list.
For now, let's address the most common errors
network administrators make while configuring HA.
We'll start by making sure that: Both nodes are registered, are of the same
model, have the same number of ports, and have identical firmware versions installed.
Both nodes must utilize the same corresponding port for the dedicated HA link on both devices.
If you choose Port C on the Primary for the dedicated HA link, you must utilize Port C
on the Auxiliary device.
SSH and Ping should be enabled on both devices
and allowed on the DMZ Zone.
To do this, navigate to Administration > Device Access and under
the Admin Services tab, check the box for SSH under DMZ.
Both nodes must have the dedicated HA link ports configured in the DMZ zone, and they
must have a unique IP address.
In addition, the HA link ports IP addresses of both the
peers must be within the same subnet.
For Active-Active, two separate licenses are
required: one for the primary device and one for the auxiliary device.
You also have to make sure that identical software subscriptions are enabled on each
device.
For Active-Passive, this is the only mode that
support dynamically configured interfaces using DHCP or PPPoE.
Active-Active does not support this.
On a more crucial note for Active-Passive, you only need a single license but
it must be applied to the primary firewall.
Otherwise, configuring HA will not work.
And finally, if you have a wireless firewall (a W-model), HA is not supported.
And with all that covered, you're ready to setup HA, which we cover in Part 2.
A link to the configuration video covering the actual HA configuration steps can be found
in the video description.
Gives us a thumbs up if you found this helpful.
Find more helpful videos like this on techvids.sophos.com and connect with us in the Sophos Community
and on social media.
This is Jay, signing off.