• High Availability
  • About High Availability
    • High Availability Terminology
    • High Availability Modes
    • High Availability Encryption
    • Crash Detection
    • Virtual MAC Address
    • Dynamic WAN Interfaces with PPPoE HA
    • Stateful Synchronization with DHCP
    • Stateful Synchronization with DNS Proxy
    • About HA Monitoring
  • About Active/Standby HA
    • Benefits of Active/Standby HA
    • Working of Active/Standby HA
  • About Stateful Synchronization
    • Benefits of Stateful Synchronization
    • How Does Stateful Synchronization Work?
    • Example of Stateful Synchronization
  • Active/Standby and Active/Active DPI Prerequisites
    • Supported Platforms and Licensing for HA
    • Physically Connecting Your Security Appliances
    • Connecting the Active/Active DPI Interfaces for Active/Active DPI
  • Maintenance
    • Removing an HA Association
    • Replacing a SonicWall Security Appliance
      • Replacing an HA Primary Unit
      • Replacing an HA Secondary Unit
• High Availability Status
  • Active/Standby High Availability Status
    • High Availability Status
    • High Availability Config
    • High Availability Licenses
• Configuring High Availability
  • Configuring Active/Standby High Availability Settings
  • Configuring HA with Dynamic WAN Interfaces
  • Configuring Network DHCP and Interface Settings
    • Disabling the SonicOS DHCP Server
    • Configuring Virtual IP Addresses
    • Configuring Redundant Ports
• Fine Tuning High Availability
  • Advanced Settings
  • Configuring Advanced High Availability Settings
• Monitoring High Availability
  • Configuring Active/Standby High Availability Monitoring
  • IPv6 High Availability Monitoring
  • IPv6 HA Monitoring Considerations
• SonicWall Support
  • About This Document

About HA Monitoring

On DEVICE | High Availability > Monitoring, you can configure both physical and logical interface monitoring:

• By enabling physical interface monitoring, you enable link detection for the designated HA interfaces. The link is sensed at the physical layer to determine link viability.
• Logical monitoring involves configuring the SonicWall to monitor a reliable device on one or more of the connected networks.

Failure to periodically communicate with the device by the Active unit in the HA Pair triggers a failover to the Standby unit. If neither unit in the HA Pair can connect to the device, no action is taken.

The Primary and Secondary IP addresses configured on DEVICE | High Availability > Monitoring can be configured on LAN or WAN interfaces, and are used for multiple purposes:

• As independent management addresses for each unit (supported on all physical interfaces)
• To allow synchronization of licenses between the Standby unit and the SonicWall licensing server
• As the source IP addresses for the probe pings sent out during logical monitoring

Configuring unique management IP addresses for both units in the HA Pair allows you to log in to each unit independently for management purposes. Note that non-management traffic is ignored if it is sent to one of these IP addresses. The Primary and Secondary Security Appliances’ unique LAN IP addresses cannot act as an active gateway; all systems connected to the internal LAN needs to use the virtual LAN IP address as their gateway.

If WAN monitoring IP addresses are configured, then X0 monitoring IP addresses are not required. If WAN monitoring IP addresses are not configured, then X0 monitoring IP addresses are required, because in such a scenario the Standby unit uses the X0 monitoring IP address to connect to the licensing server with all traffic routed through the Active unit.

The management IP address of the Secondary/Standby unit is used to allow license synchronization with the SonicWall licensing server, which handles licensing on a per-Security Appliance basis (not per-HA Pair). Even if the Secondary unit was already registered on MySonicWall before creating the HA association, you must use the link on Device | Settings > Licenses to connect to the SonicWall server while accessing the Secondary Security Appliance through its management IP address (for more information, see SonicOS 7 Settings document).

When using logical monitoring, the HA Pair pings the specified Logical Probe IP address target from the Primary as well as from the Secondary unit. The IP address set in the Primary IP Address or Secondary IP Address field is used as the source IP address for the ping. If both units can successfully ping the target, no failover occurs. If both cannot successfully ping the target, no failover occurs, as SonicOS assumes that the problem is with the target, and not the Security Appliances. If one Security Appliance can ping the target but the other cannot, however, the HA Pair failovers to the unit that can ping the target.

The configuration tasks on DEVICE | High Availability > Monitoring are performed on the Primary unit and then are automatically synchronized to the Secondary.