What is a firewall high-availability (HA) cluster, and what are the active-passive vs active-active modes?
An HA firewall cluster = two or more firewalls sharing state and traffic, so failure of one doesn't drop connections. Active-passive: one handles all traffic, the other waits to take over. Active-active: both handle traffic simultaneously, sharing load.
* HA modes: active-passive vs active-active, both with state sync. *
The setup:
[Internet]
│
┌────────┴────────┐
│ │
[Router 1] [Router 2]
│ │
├──[FW Cluster]───┤
│ ↕ state sync │
[FW 1] [FW 2]
│ │
└────────┬────────┘
│
[Intranet]
The two modes:
| Mode | Traffic distribution | Failover |
|---|---|---|
| Active-Passive | FW1 handles 100% of traffic; FW2 idle | If FW1 dies, FW2 takes over (sub-second) |
| Active-Active | FW1 and FW2 each handle ~50% | If one dies, other handles 100% |
Critical feature — connection state sync:
FW1 (active): Connection A from 10.0.0.5 to 1.2.3.4 — ACTIVE
↓ syncs state to ↓
FW2 (passive): Connection A from 10.0.0.5 to 1.2.3.4 — TRACKED
↓ if FW1 fails ↓
FW2 takes over: continues handling Connection A WITHOUT dropping
As HA vendors put it: "Bestehende Verbindungen gehen NICHT verloren" — existing connections survive failover. This is what distinguishes HA from "just another firewall."
How failover is triggered:
| Trigger | Detection method |
|---|---|
| Hardware failure | Heartbeat between FWs lost |
| Power failure | Same |
| Software crash | Heartbeat lost |
| Network interface down | Link state monitoring |
| Service hung | Periodic self-test from peer |
The "fully automatic" claim:
"Firewall-Umschaltung vollautomatisch"
A correctly-configured HA cluster fails over in 1-3 seconds. The active firewall's interfaces use virtual IPs (VRRP / HSRP-style) — when FW1 dies, FW2 claims the same VIPs and starts answering ARP requests for them.
Why active-active is harder:
In active-active mode, both firewalls must share connection state in real-time AND not duplicate decisions. This requires:
- Symmetric routing (return traffic must go through the same FW that saw the request)
- Session ownership protocols (which FW "owns" a flow)
- Faster state-sync (microseconds, not seconds)
Active-active offers more throughput but is harder to configure correctly and more sensitive to network changes.
Tip: For most enterprises, active-passive is the default — it's simpler and the wasted "idle" capacity buys you a clean failover model. Active-active is for environments where the firewall is the throughput bottleneck.
Go deeper:
High-availability cluster (Wikipedia) — active/active vs active/passive and heartbeat-based failover.- VRRP (Wikipedia) — the virtual-IP failover mechanism the card invokes.