Crash Detection

The HA feature has a thorough self-diagnostic mechanism for both the Active and Standby firewalls. The failover to the standby unit occurs when critical services are affected, physical or logical link failure is detected on monitored interfaces, or when the firewall loses power.

The self-checking mechanism is managed by software diagnostics, which check the complete system integrity of the firewall. The diagnostics check internal system statuses, system process statuses, and network connectivity. Each firewall calculates a connectivity score, and the firewall with the better score becomes Active. This prevents repeated failovers.

Critical internal system processes such as NAT, VPN, and DHCP (among others) are checked in real time. The firewall isolates the failing service as early as possible and attempts to restart it.

In Active/Active DPI mode, crash detection monitors the health of both firewalls. In addition to standard system, process, and link monitoring, the HA subsystem verifies the DPI offload communication path between the two firewalls.

If the Standby firewall that processes the offloaded DPI traffic has a critical failure, such as a system crash, loss of monitored interfaces, or loss of communication between the firewalls, the HA pair stops DPI offloading and continues as a standard Active/Standby pair.