Stateful Synchronization with DHCP

DHCP can be enabled on interfaces in Active/Standby mode with or without Stateful Synchronization.

Only the Active firewall can get a DHCP lease. The Active firewall synchronizes the DHCP IP address along with the DNS and gateway addresses to the Standby firewall. The DHCP client ID is also synchronized, allowing this feature to work even without enabling Virtual MAC.

During a failover, the former Active firewall releases the DHCP lease, and the Standby firewall, which becomes Active, renews the lease using the existing DHCP IP address and client ID. The IP address does not change, and network traffic, including VPN tunnel traffic, continues to pass.

If the Active firewall does not have an IP address when failover occurs, the Standby firewall starts a new DHCP discovery.