Configure access layer switches for XGS HA

The following network diagram shows the network configuration used as a reference in this guide.

High availability network diagram.

Connectivity details:

Port1 of the firewall is connected to Port14 of the CS210-48FP switch.
Port13 of the CS210-48FP switch is connected to the LAN network.
Port5 of the firewall is connected to Port26 of the CS210-48FP switch.
Port25 of the CS210-48FP switch is connected to the DMZ network.
Port t4 of the firewall is connected to Port25 and Port27 of the CS110-24FP switch.
Port26 of CS110-24FP switch connected to the internet.
Port7 of both the firewall devices is a dedicated HA link port connected to each other directly.
Port52 of both CS210-48FP switches is connected directly as a redundant port.

To configure your switches, do as follows:

Configure the CS110-24FP switch

UI configurationCLI configuration

Go to Configure > VLAN settings > 802.1Q.
1. Click Add and create VLAN ID 300.
2. Enter a name for the VLAN.
Click Apply to save the changes.

Here's an example:
Click Edit, select the Untagged text box, select ports 25, 26, and 27, and click the tick mark.
Click Apply to save the changes.
Go to PVID and ingress filter.
Select ports 25, 26, and 27, and then click Edit.
Select the following settings:
1. PVID: 300 (WANHA).
2. Ingress filtering: On.
3. Accept type: All.
Click Apply.

Sign in to the switch CLI and enter the configuration mode.
```
configure terminal
```
Create VLAN 300.
```
vlan 300
```
Name the VLAN WANHA.
```
ports name WANHA
```

Assign the tagged and untagged ports for the VLAN.

ports add gigabitethernet 0/25-27 untagged gigabitethernet 0/25-27

Select ports 25, 26, and 27.

interface range gigabitethernet 0/25-27

Assign PVID 300 to ports 25, 26, and 27.
```
switchport pvid 300
```
Set acceptable frame types for the ports.
```
switchport acceptable-frame-type all
```
Turn on the ingress filter.
```
switchport ingress-filter
```
Exit the interface configuration mode.
```
exit
```
Exit the configuration mode.
```
exit
```
Save the configuration.
```
save
```

UI configurationCLI configuration

Go to Configure > VLAN settings > 802.1Q.
1. Click Add, and create the VLAN IDs 100 and 200.
2. Enter a name for the VLANs.
Click Apply.

Here's an example:
Click Edit for VLAN ID 100, select the Tagged text box and select Port 52. Select the Untagged text box, select ports 13 and 14, and click the tick mark.
Click Apply to save the changes.
Click Edit for VLAN ID 200, select the Tagged text box and select Port 52. Select the Untagged text box, select ports 25 and 26, and click the tick mark.
Click Apply to save the changes.
Go to PVID and ingress filter and select ports 13 and 14. Click Edit.
Select the following settings:
1. PVID: LANHA (VLAN 100).
2. Ingress filtering: On.
3. Accept type: All.
Click Apply.
Select the ports 25 and 26 and click Edit.
Select the following settings:
1. PVID: DMZHA (VLAN 200).
2. Ingress filtering: On.
3. Accept type: All.
Click Apply.

Sign in to the switch CLI and enter the configuration mode.
```
configure terminal
```
Create VLAN 100.
```
vlan 100
```
Name the VLAN LANHA.
```
ports name LANHA
```

Assign the tagged and untagged ports for the VLAN.

ports add gigabitethernet 0/13-14 untagged gigabitethernet 0/13-14

Select interfaces 13 and 14.

interface range gigabitethernet 0/13-14

Assign VLAN 100 to ports 13 and 14.
```
switchport pvid 100
```
Set the acceptable frame type for the port.
```
switchport acceptable-frame-type all
```
Turn on the ingress filter for the ports.
```
switchport ingress-filter
```
Exit the interface configuration mode.
```
exit
```
Exit the configuration mode.
```
exit
```
Save the configuration.
```
save
```
Enter the configuration mode.
```
configure terminal
```
Create VLAN 200.
```
vlan 200
```
Name the VLAN DMZHA.
```
ports name DMZHA
```

Add the untagged and tagged ports to the VLAN.

ports add gigabitethernet 0/25-26 untagged gigabitethernet 0/25-26

Select ports 25 and 26.

interface range gigabitethernet 0/25-26

Assign VLAN 200 to the ports.
```
switchport pvid 200
```
Set the acceptable frame type for the ports.
```
switchport acceptable-frame-type all
```
Turn on the ingress filter for the ports.
```
switchport ingress-filter
```
Exit the interface configuration mode.
```
exit
```
Exit the configuration mode.
```
exit
```
Save the configuration.
```
save
```

Go to System Services > High Availability and specify the settings as follows:
1. Initial device role: Auxiliary.
2. HA configuration mode: Interactive mode.
3. Passphrase: Create your own passphrase.
4. Dedicated HA Link Port: Port7. This must be the same port on both the firewall devices.
Click Initiate HA.

If these details aren't configured on the auxiliary device, the primary device won't be able to connect to the auxiliary device.

To check the status of HA, go to Control Center and locate the HA details widget. It shows the configured HA mode.

Verify HA status.