The active/active failover mechanism used on firewall devices leverages the virtual context feature. The best results are obtained when the two devices configured with active/active failover have an identical platform and operating system. The two firewalls must be connected with a failover state link and this can be accomplished in one of three ways:
- Single physical link: both the failover and stateful information are transmitted on this link
- Dual physical links: the failover information is exchanged on one interface and the stateful information (maintaining the TCP connection and translation rules) on another
- Dual redundant physical links: these act as a single logical link that carries both the failover and stateful information between the firewalls
Figure 31.2 – Active/Active Failover Firewall Deployment
Although you are using two devices that are identical, you have to leverage the security contexts feature. As depicted in Figure 31.2 above, this is accomplished by defining two security contexts on each firewall, which will accomplish the following functions:
- Context 1 is the active firewall for the left device (FW 1)
- Context 3 is the standby firewall for the left device (FW 1)
- Context 2 is the standby firewall for the right device (FW 2)
- Context 4 is the active firewall for the right device (FW 2)
This scenario basically gives you two virtual firewalls, with the physical devices partitioned into one active and one standby context. Contexts 1 and 3 in Figure 31.2 are logically grouped across the two physical devices, just like contexts 2 and 4 are. In many situations the security contexts feature will serve only as a mechanism to create active/active failover configurations, but on high-end devices you can use this functionality both for creating active/active topologies and assigning a set of VLANs to each virtual firewall.