Skip to content
The XG Series hardware appliances will reach end-of-life (EOL) on March 31, 2025. Click here to see the XG to XGS migration documentation.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/21.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=HA-load-balancing

Load-balancing

Traffic load-balancing takes place in active-active HA.

Load-balancing method

The primary device receives all traffic requests and load-balances the traffic as follows:

  • TCP traffic is load-balanced based on even-numbered or odd-numbered source IP addresses.

    The primary device processes traffic from even-numbered source IP addresses, such as 10.1.1.10. It forwards traffic from odd-numbered source IP addresses, such as 10.1.1.11, to the auxiliary device. After the auxiliary device processes traffic, packets are directly sent to the destination without going through the primary device.

  • Non-TCP, SD-RED, tunneled TCP, and tunneled non-TCP traffic aren't load-balanced.

  • External load-balancers aren't supported.
  • The load-balancing method can't be changed.

Layers 3 and 4

Traffic Load-balancing
Forwarded TCP and translated traffic (including SNAT and virtual host traffic)
VLAN
UDP, ICMP, multicast, broadcast
VPN

Layer 7

Traffic Load-balancing
DPI engine, transparent, direct, and parent proxies
SMTP proxy traffic
HTTPS
Scanned FTP
H.323