Configuring Active/Active DPI High Availability Settings

Configure Active/Active DPI on the Primary firewall. SonicOS synchronizes the settings to the Secondary firewall.

Before you configure Active/Active DPI, verify that both firewalls are supported models and that each firewall has an unassigned interface for the dedicated connection. For the requirements and cabling, see Connecting the Active/Active DPI Interface.

To configure Active/Active DPI

1. Navigate to DEVICE | High Availability > Settings.
2. In the GENERAL SETTINGS section, do the following:
   1. From the Mode drop-down menu, select Active/Active DPI. A message displays that states that Active/Active DPI requires current licenses and signature updates on both firewalls.

   2. Click OK.

      SonicOS turns on Enable Stateful Synchronization automatically and dims the option.

   3. Verify that Enable Preempt Mode is not selected. This option is not selected by default.

      Do not enable Preempt Mode for Active/Active DPI. Preempt Mode instructs the Primary firewall to take back the Primary role when it restarts after a failure. If you enable it, the Primary firewall takes the Active role again after each restart, and the pair fails over a second time.

   4. (Optional) Select Enable Virtual MAC to allow both Primary and Secondary firewalls to share a single MAC address. This greatly simplifies the process of updating network ARP tables and caches when a failover occurs. This option is not selected by default.

      Only the switch to which the two firewalls are connected needs to be notified. All outside devices continue to route to the single shared MAC address.

   5. (Optional) Select Enable Encryption for Control Communication to encrypt HA control communication between the active and standby firewalls. This option is not selected by default.

      Firewall performance may be affected if you choose encryption.

      A confirmation message displays:

      

   6. Click OK.

3. In the HA DEVICES section, enter the Serial Number of the Secondary Device.

   The serial number for the Primary Device is displayed, but the field is dimmed and cannot be edited.

   

4. In the HA INTERFACES section:

   1. Select the interface for the HA Control Interface.

      This option is dimmed, and the interface is displayed if the firewall detects that the interface is already configured.

   2. Select the interface for the HA Data Interface. This interface is required for Active/Active DPI.

      This option is dimmed, and the interface is displayed if the firewall detects that the interface is already configured.

   3. From the Active/Active DPI Interface drop-down menu, select the dedicated interface.

      If the interface is already configured, the field displays the configured interface and is dimmed.

      The Active/Active DPI interface carries offloaded DPI traffic between the appliances. It must be different from the interfaces selected for HA Control Interface and HA Data Interface.

      Only available, unassigned interfaces appear in the drop-down menu. For the interface requirements, see Connecting the Active/Active DPI Interface.

   4. Click Accept to complete the High Availability configuration.

      SonicOS synchronizes all settings to the Secondary firewall, and the Secondary firewall reboots.

To configure when offloading begins and the percentage of eligible DPI traffic to offload, see Configuring Advanced High Availability Settings.