High availability enables network-wide protection by providing fast recovery from faults that may occur in any part of a network. High availability enables rapid recovery from disruptions to users and network applications.

The zone-based policy firewall supports active/active and active/standby high availability failover and asymmetric routing.

The active/active failover allows both devices involved in the failover to forward traffic simultaneously.

When active/standby high availability failover is configured, only one of the devices involved in the failover handles the traffic at one time, while the other device is in a standby mode, periodically synchronizing session information from the active device.

Asymmetric routing supports the forwarding of packets from a standby redundancy group to an active redundancy group for packet handling. If this feature is not enabled, the return TCP packets forwarded to the device that did not receive the initial synchronization (SYN) message are dropped because they do not belong to any known existing session.

You can configure pairs of devices to act as hot standby devices for each other. Redundancy is configured on an interface basis. Pairs of redundant interfaces are known as redundancy groups (RGs). An RG must be configured under the interface in order for the zone-based policy firewall to correctly replicate connections in a high availability setup. In order for the firewall to synchronize connections, an RG must be associated with an interface.

Figure 1 depicts an active/standby load-sharing scenario. It shows how a redundancy group is configured for a pair of devices that has one outgoing interface. Figure 2 depicts an active/active load-sharing scenario. It shows how two redundancy groups are configured for a pair of devices that have two outgoing interfaces.

In both cases, the redundant devices are joined by a configurable control link, a data synchronization link, and an interlink interface. The control link is used to communicate the status of the devices. The data synchronization link is used to transfer stateful information from the firewall and to synchronize the stateful database. The pairs of redundant interfaces are configured with the same unique ID number, known as the redundant interface identifier (RII).

Asymmetric routing is supported as part of the firewall high availability. In a LAN-WAN scenario, where the return traffic enters standby devices, asymmetric routing is supported. To implement the asymmetric routing functionality, configure both the redundant devices with a dedicated interface (interlink interface) for asymmetric traffic. This dedicated interface will redirect the traffic coming to the standby WAN interface to the active device.

Figure 2. Redundancy Group Configuration—Two Outgoing Interfaces

The hello time defaults to 3 seconds to align with the Hot Standby Router Protocol (HSRP), and the hold time defaults to 10 seconds. You can also configure these timers in milliseconds by using the timers hellotime msec command.

To determine which pairs of interfaces are affected by the switchover, you must configure a unique ID for each pair of redundant interfaces. This ID is known as the RII that is associated with the interface.

A switchover to the standby device can occur under other circumstances. Another factor that can cause a switchover is a priority setting that can be configured on each device. The device with the highest priority value will be the active device. If a fault occurs on either the active or the standby device, the priority of the device is decremented by a configurable amount, known as the weight. If the priority of the active device falls below the priority of the standby device, a switchover occurs and the standby device becomes the active device. This default behavior can be overridden by disabling the preemption attribute for the redundancy group. You can also configure each interface to decrease the priority when the Layer 1 state of the interface goes down. The priority that is configured overrides the default priority of a redundancy group.

Each failure event that causes a modification of a redundancy group’s priority generates a syslog entry that contains a time stamp, the redundancy group that was affected, the previous priority, the new priority, and a description of the failure event cause.

Another situation that can cause a switchover to occur is when the priority of a device or interface falls below a configurable threshold level.

In an active/active failover configuration, both devices can process network traffic. Active/active failover generates virtual MAC (VMAC) addresses for interfaces in each redundancy group (RG).

Active/standby failover enables you to use a standby device to take over the functionality of a failed device. A failed active device changes to the standby state, and the standby device changes to the active state. The device that is now in the active state takes over IP addresses and MAC addresses of the failed device and starts processing traffic. The device that is now in the standby state takes over standby IP addresses and MAC addresses. Because network devices do not see any change in the MAC-to-IP address pairing, Address Resolution Protocol (ARP) entries do not change or time out anywhere on the network.

In an active/standby scenario, the main difference between two devices in a failover pair depends on which device is active and which device is a standby, namely which IP addresses to use and which device actively passes the traffic. The active device always becomes the active device if both devices start up at the same time (and are of equal operational health). MAC addresses of the active device are always paired with active IP addresses.

Asymmetric routing occurs when packets from TCP or UDP connections flow in different directions through different routes. In asymmetric routing, packets that belong to a single TCP or UDP connection are forwarded through one interface in a redundancy group (RG), but returned through another interface in the same RG. In asymmetric routing, the packet flow remains in the same RG. When you configure asymmetric routing, packets received on the standby RG are redirected to the active RG for processing. If asymmetric routing is not configured, the packets received on the standby RG may be dropped.

Asymmetric routing determines the RG for a particular traffic flow. The state of the RG is critical in determining the handling of packets. If an RG is active, normal packet processing is performed. In case the RG is in a standby state and you have configured asymmetric routing and the asymmetric-routing always-divert enable command, packets are diverted to the active RG. Use the asymmetric-routing always-divert enable command to always divert packets received from the standby RG to the active RG.

The figure below shows an asymmetric routing scenario with a separate asymmetric-routing interlink interface to divert packets to the active RG.

Figure 3. Asymmetric Routing Scenario

The following rules apply to asymmetric routing:

Asymmetric routing consists of an interlink interface that handles all traffic that is to be diverted. The bandwidth of the asymmetric-routing interlink interface must be large enough to handle all expected traffic that is to be diverted. An IPv4 address must be configured on the asymmetric-routing interlink interface, and the IP address of the asymmetric routing interface must be reachable from this interface.

Note	We recommend that the asymmetric-routing interlink interface be used for interlink traffic only and not be shared with high availability control or data interfaces because the amount of traffic on the asymmetric-routing interlink interface could be quite high.

In a WAN-LAN topology, two devices are connected through LAN interfaces on the inside and WAN interfaces on the outside. There is no control on the routing of return traffic received through WAN links.

WAN links can be provided by the same service provider or different service providers. In most cases, WAN links are provided by different service providers. To utilize WAN links to the maximum, configure an external device to provide a failover.

On LAN-based interfaces, a high availability virtual IP address is required to exchange client information and for faster failover. On WAN-based interfaces, the redundancy group id ip virtual-ip decrement value command is used for failover.

Virtual IP (VIP) addresses and virtual MAC (VMAC) addresses are used by security applications to control interfaces that receive traffic. An interface is paired with another interface, and these interfaces are associated with the same redundancy group (RG). The interface that is associated with an active RG exclusively owns the VIP and VMAC. The Address Resolution Protocol (ARP) process on the active device sends ARP replies for any ARP request for the VIP, and the Ethernet controller for the interface is programmed to receive packets destined for the VMAC. When an RG failover occurs, the ownership of the VIP and VMAC changes. The interface that is associated with the newly active RG sends a gratuitous ARP and programs the interface’s Ethernet controller to accept packets destined for the VMAC.

Virtual fragmentation reassembly (VFR) enables the firewall to create dynamic access control lists (ACLs) to protect the network from various fragmentation attacks. VFR is high availability-aware. When the firewall is enabled for high availability, fragmented packets that arrive on the standby redundancy group (RG) are redirected to the active redundancy group. Use the ip virtual-reassembly command to enable VFR on an interface.

Note	VFR should not be enabled on a device that is placed on an asymmetric path. The reassembly process requires all fragments within an IP datagram. Devices placed in the asymmetric path may not receive all IP fragments, and the fragment reassembly will fail.

1.    enable


2.    configure terminal


3.    parameter-map type inspect global


4.    redundancy


5.    log dropped-packets enable


6.    exit


7.    redundancy


8.    application redundancy


9.    group id


10.    name group-name


11.    preempt


12.    priority value


13.    control interface-type interface-number protocol id


14.    data interface-type interface-number


15.    asymmetric-routing interface type number


16.    Configure Step 7 to Step 11 to create another redundancy group on the same device.


17.    end

Device> enable

Device# configure terminal

Device(config)# parameter-map type inspect global

Device(config-profile)# redundancy

Device(config-profile)# log dropped-packets enable

Device(config-profile)# exit

Device(config)# redundancy

Device(config-red)# application redundancy

Device(config-red-app)# group 1

Device(config-red-app-grp)# name RG1

Device(config-red-app-grp)# preempt

Device(config-red-app-grp)# priority 230

Device(config-red-app-grp)# control gigabitethernet 0/0/1 protocol 1

Device(config-red-app-grp)# data gigabitethernet 0/0/1

Device(config-red-app-grp)# asymmetric-routing interface gigabitethernet 0/0/1

Device(config-red-app-grp)# end

1.    enable


2.    configure terminal


3.    class-map type inspect match-any class-map-name


4.    match protocol protocol-name


5.    exit


6.    parameter-map type inspect global


7.    redundancy


8.    exit


9.    policy-map type inspect policy-map-name


10.    class type inspect class-map-name


11.    inspect


12.    exit


13.    class class-default


14.    drop


15.    exit


16.    exit


17.    zone security zone-name


18.    exit


19.    zone security zone-name


20.    exit


21.    zone-pair security zone-pair-name source zone-name destination zone-name


22.    service-policy type inspect policy-map-name


23.    exit


24.    zone-pair security zone-pair-name source zone-name destination zone-name


25.    service-policy type inspect policy-map-name


26.    exit


27.    interface type number


28.    ip address ip-address mask


29.    encapsulation dot1q vlan-id


30.    zone-member security security-zone-name


31.    end


32.    show policy-firewall session zone-pair ha


33.    debug policy-firewall ha

Device> enable

Device# configure terminal

Device(config)# class-map type inspect match-any cmap-l4-Protocol

Device(config-cmap)# match protocol tcp

Device(config-cmap)# exit

Device(config)# parameter-map type inspect global

Device(config-profile)# redundancy

Device(config-profile)# exit

Device(config)# policy-map type inspect pmap-l4-Protocols

Device(config-pmap)# class type inspect cmap-l4-Protocol

Device(config-pmap-c)# inspect

Device(config-pmap-c)# exit

Device(config-pmap)# class class-default

Device(config-pmap-c)# drop

Device(config-pmap-c)# exit

Device(config-pmap)# exit

Device(config)# zone security TWAN

Device(config-sec-zone)# exit

Device(config)# zone security DATA

Device(config-sec-zone)# exit

Device(config)# zone-pair security zp-TWAN-DATA source TWAN destination data

Device(config-sec-zone-pair)# service-policy type inspect pmap-l4-Protocols

Device(config-sec-zone)# exit

Device(config)# zone-pair security zp-DATA-TWAN source DATA destination TWAN

Device(config-sec-zone-pair)# service-policy type inspect pmap-l4-Protocols

Device(config-sec-zone-pair)# exit

Device(config)# interface gigabitethernet 0/0/0 

Device(config-subif)# ip address 10.1.1.1 255.255.255.0 

Device(config-subif)# encapsulation dot1q 2

Device(config-subif)# zone-member security private

Device(config-sec-zone-pair)# end

Device# show policy-firewall session zone-pair ha

Device# debug policy-firewall ha

1.    enable


2.    configure terminal


3.    interface type number


4.    description string


5.    ip address ip-address mask


6.    zone-member security zone-name


7.    ip tcp adjust-mss max-segment-size


8.    redundancy rii RII-identifier


9.    redundancy asymmetric-routing enable


10.    end

Device> enable

Device# configure terminal

Device(config)# interface gigabitethernet 0/0/2.1

Device(config-subif)# description wan interface

Device(config-subif)# ip address 10.0.0.1 255.255.255.0

Device(config-subif)# zone-member security TWAN

Device(config-subif)# ip tcp adjust-mss 1360

Device(config-subif)# redundancy rii 360 

Device(config-subif)# redundancy asymmetric-routing enable

Device(config-subif)# end

1.    enable


2.    configure terminal


3.    interface type number


4.    description string


5.    encapsulation dot1q vlan-id


6.    ip vrf forwarding name


7.    ip address ip-address mask


8.    zone-member security zone-name


9.    redundancy rii RII-identifier


10.    redundancy group id ip ip-address exclusive


11.    end

Device> enable

Device# configure terminal

Device(config)# interface gigabitethernet 0/0/2.1         

Device(config-subif)# description lan interface

Device(config-subif)# encapsulation dot1q 18

Device(config-subif)# ip vrf forwarding trust

Device(config-subif)# ip address 10.0.0.1 255.255.255.0

Device(config-subif)# zone-member security data

Device(config-subif)# redundancy rii 100

Device(config-subif)# redundancy group 1 ip 10.0.0.1 exclusive

Device(config-subif)# end