HA architecture and design

Read about how the firewall assigns virtual MAC addresses and how packets flow through an HA cluster.

Virtual MAC design

The HA cluster uses a virtual MAC address, which is always owned by the current primary device. The virtual MAC address isn't the same as the physical MAC address of any interface in the cluster.

The primary device uses the virtual MAC address to respond to ARP requests made to the cluster. The auxiliary device never responds to ARP requests. The auxiliary device uses its own physical MAC address.

All clients connecting to the cluster use the virtual MAC address. There's one virtual MAC address for each interface, except the dedicated HA link.

The virtual MAC address is calculated based on the cluster ID that you assign. Therefore, you must use a unique ID for each HA cluster.

Here's an example of how the virtual MAC address is assigned to the primary device, and how it responds to an ARP request.

Packet flow

Traffic is always sent to the primary device because it responds to ARP requests with the virtual MAC address. The primary device sends the packet to the destination. When the primary device receives the reply from the destination, it sends it back to the source.

Here's an example of the packet flow when the primary device processes a packet. This could be either:

• Active-passive, where the primary is processing all the traffic.
• Active-active, where the primary is processing a packet.