Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=HA-configuration

Interface requirements

Review the requirements for dedicated HA links, monitored ports, and administration ports used for HA communication, failover monitoring, and device management.

Firewall interfaces

Review the physical and virtual interface configurations supported in HA deployments. Some interface types are supported for HA but can't be used as dedicated HA links or administration ports.

Interface type Active-passive Active-active

DHCP

DHCP prefix delegation

Only use static IP addresses for the dedicated HA link and administration ports.

Only use static IP addresses for all interfaces.
PPPoE

Session failover doesn't occur.

Only use static IP addresses for the dedicated HA link and administration ports.

Only use static IP addresses for all interfaces.
Bridge interface

Can't use it for dedicated HA link.

Can't use it for a dedicated HA link.

In this deployment, traffic received on VLAN interfaces configured on bridge interfaces isn't load balanced between HA nodes. Only the primary node processes the traffic.
Alias IP address

Can't use it for dedicated HA link.

Can't use it for dedicated HA link.
Cellular WAN

Note

HA can't be configured if you've turned on Cellular WAN. So, go to Network > Cellular WAN and turn it off.

Breakout interfaces

Review the following scenarios to understand how breakout interface configurations are synchronized between the primary and auxiliary devices.

  • When you configure breakout interfaces on the primary device: Restart the primary device to apply the configuration, then restart the auxiliary device.
  • Primary device has breakout interfaces: After the breakout configuration is synchronized to the auxiliary device, restart the auxiliary device for the configuration to take effect.
  • Primary device doesn't have breakout interfaces: The auxiliary device's breakout interface configurations are deleted during synchronization.

HA port configuration

HA ports are used for device management, device monitoring, and HA communication. The port requirements differ based on their role in the HA deployment.

Dedicated HA links connect the HA devices and are used for encrypted communication between these devices.

Interfaces

Identify the DMZ ports you want to use for Dedicated HA link. They can be physical, VLAN, or LAG interfaces, and must meet the following requirements:

  • Make sure they don't have dependent configurations. These configurations are deleted when HA is initiated.
  • Assign static IP addresses to these interfaces.
  • Make sure they belong to the same subnet but have different IP addresses on the primary and auxiliary devices.

  • When you configure one of the following interfaces as the dedicated HA link, the heartbeat time-out must be at least 2500 milliseconds:

    • LAG
    • VLAN over LAG

    The heartbeat time-out is calculated by multiplying Keepalive request interval by Keepalive attempts.

    Example

    Keepalive request interval: 250 milliseconds

    Keepalive attempts: 10

    Heartbeat time-out: 250 * 10 = 2500 milliseconds

Note

If you select unbound interfaces for the dedicated HA link in QuickHA mode, verify the advanced settings after you configure HA. The firewall assigns these interfaces to the DMZ and resets the advanced settings.

Advanced settings

Use the default values, or make sure the settings match those of the connected device. Connected devices can be network devices, such as switches, or the peer HA device.

  1. Use the default MTU and MSS values.

  2. For 25, 50, and 100 GbE ports used in XGS 8500 and XGS 7500 Series firewalls, specify Link mode as follows:

    1. Select the port speed and duplex to match the connected device.

      For ports with 10 GbE or lower speed, you can also set Link mode to Automatic.

    2. Click Save.

    3. Edit the interface, click Show recommended settings, and then click Load recommended configuration to automatically load the auto-negotiation and Forward Error Correction (FEC) settings.

    4. Click Save.

      Note

      If no recommended settings are available, turn off Auto-negotiation for media type and FEC.

    For more information, see Configure physical interfaces.

Monitored ports

Monitored ports are physical interfaces that HA monitors to determine the availability of each device. If a monitored port becomes unavailable, HA initiates a failover.

  1. Identify monitored ports that are different from the dedicated HA link ports.
  2. Only use static IP addresses for these interfaces.

Note

You can add a maximum of 24 monitored ports.

Administration ports for web admin consoles

Administration ports are the administration or management interfaces used to access the primary and the auxiliary devices' web admin consoles.

Default IP addresses

The web admin console's default IP address varies by port type:

  • Regular ports: 172.16.16.16
  • Management ports (PortMGMT): 10.0.1.1

Access the auxiliary device's web admin console

You can't access the auxiliary device's web admin console using the primary device's administration IP address. So, do as follows:

  1. Identify the subnet you want to use for the administration or management ports on both devices.

  2. Assign a different IP address from this subnet to each device's administration ports.

    If you use the same IP address on both devices, you can't access the auxiliary device's web admin console.

  3. Use only static IP addresses for these interfaces.

Note

You can access the primary device's web admin console from any zone if you've allowed HTTPS access from that zone on Administration > Device access.

To access the auxiliary device's web admin console, your endpoint device must be in the same subnet as the auxiliary device.