Configuring Advanced High Availability Settings

To configure advanced settings

1. Log in as an administrator to the SonicOS Management Interface on the Active firewall.

   You can configure the settings only on the Active firewall. The Standby firewall operates in read-only mode.

2. Navigate to DEVICE | High Availability > Advanced.

   

3. In the Heartbeat Interval (milliseconds) field, specify how frequently the firewalls in the High Availability pair exchange heartbeat messages. This setting applies across both units in the HA pair and helps determine peer health and responsiveness.

   • Default: 1,000 milliseconds (1 second)

   • Range: 1,000–300,000 milliseconds

   .Use higher intervals in high-traffic environments to reduce processing overhead. Lower intervals increase sensitivity and may cause unnecessary failovers during periods of temporary network congestion. This timer works in conjunction with the Failover Trigger Level (missed heartbeats).

4. In the Failover Trigger Level (missed heartbeats) field, define how many consecutive heartbeats can be missed before initiating a failover. This setting applies to both units in the HA pair.

   This setting works together with the Heartbeat Interval timer. For example, if the Failover Trigger Level is set to 5 and the Heartbeat Interval is 10,000 milliseconds (10 seconds), the system waits 50 seconds without receiving a heartbeat before triggering failover.

   • Default: 5

   • Range: 4–99

5. In the Probe Interval (seconds) field, enter the number of seconds between probes sent to the specified IP address(es) to verify that the network’s critical path remains reachable. Logical monitoring for the HA pair uses this interval.

   • Default: 20 seconds

   • Range: 5–255 seconds

6. In the Probe Count field, specify how many consecutive missed probes must occur before SonicOS determines that the critical path or probe target is unreachable. Logical monitoring uses this count for HA failover decisions.

   • Default: 3

   • Range: 3–10

7. In the Election Delay Time (seconds) field, specify how long the Active firewall waits before considering an interface “up” and stable. It is useful when switch ports have spanning‑tree delays.

   • Default: 3 seconds

   • Range: 3–255 seconds

8. In the Dynamic Route Hold-Down Time (seconds) field, enter the duration for which the new Active firewall retains old dynamic routing entries after failover. This allows time to relearn routes from dynamic routing protocols (RIP, OSPF, BGP) before replacing old entries.

   • Default: 45 seconds

   • Range: 0–1200 seconds (20 minutes)

   The Dynamic Route Hold-Down Time setting is displayed only when the Advanced Routing Mode option is selected on NETWORK | System > Dynamic Routing > Settings.

   In large or complex networks, a larger value may improve network stability during a failover.

   This setting is used when a failover occurs on a High Availability pair that uses a dynamic routing protocol. During this time, the new Active firewall relearns the dynamic routes in the network. When the dynamic route hold-down time duration expires, SonicOS deletes the old routes and implements the new routes it has learned from routing protocols.

9. In the SD‑WAN Probes Hold‑Down Time (seconds) field, specify how long SonicOS waits before it restores a previously failed WAN path to the active state.

   • Default: 30 seconds

   • Range: 0–3600 seconds

10. Select Active/Standby Failover only when ALL aggregate links are down to fail over only when every aggregate link is down. An aggregate link is a group of physical interfaces that SonicOS combines as one logical link. This option is not selected by default.
11. Select Include Certificates/Keys to synchronize all certificates and keys within the HA pair. This option is selected by default.

    Synchronization copies private keys from one firewall to the other. Use a secure connection between the firewalls for the HA control and data links.

12. In the Active/Active DPI Traffic Offload % field, enter the percentage of DPI-eligible traffic that the Active firewall forwards to the Standby firewall when the CPU threshold is met.

    • Default: 60%

    • Range: 0–100%

    For example, a value of 60% specifies that 60% of eligible DPI traffic is to be offloaded after the CPU threshold is reached.

    This setting applies to DPI-eligible traffic, not to all traffic passing through the firewall. A value of 100% does not mean that all firewall traffic or all firewall processing is transferred to the Standby firewall.

13. In the Active/Active DPI CPU Threshold % field, enter the CPU utilization level on the Active firewall that triggers DPI offloading.

    • Default: 60%

    • Range: 0–100%

    When CPU utilization reaches or exceeds the configured threshold, the Active firewall begins forwarding the percentage of eligible DPI traffic specified in Active/Active DPI Traffic Offload % to the Standby firewall.

    Setting the CPU threshold to 0% allows offloading to begin without waiting for CPU utilization to increase.

    For example, setting Active/Active DPI Traffic Offload % to 100% and Active/Active DPI CPU Threshold % to 0% allows eligible DPI traffic to be offloaded as soon as it is available.

    .These settings control inspection offloading. They do not change which appliance forwards traffic between the LAN and WAN.

14. (Optional) To force synchronize the SonicOS preference settings between the Primary and Secondary firewalls, click Synchronize Settings.

15. (Optional) Click Synchronize Firmware to synchronize the firmware version between the Primary and Secondary firewalls.
16. (Optional) Click Force Active/Standby Failover to test that failover works. The firewalls switch roles, which briefly interrupts traffic.

    Run this test during a maintenance window. The failover interrupts traffic.

17. Click Accept to complete the High Availability configuration.

    SonicOS synchronizes all settings to the Secondary firewall.