High Availability Modes

High Availability has several operation modes, which can be selected on Device > High Availability > Settings.

Choosing the right High Availability Operation mode depends on understanding the network in question, its purpose and operational needs. In planning, the administrator should understand:

• Operational requirements for up time

• Repercussions of failure

• Calculated risk to operations

Each operation mode satisfies a different scenario and without knowing the goals of High Availability, administrators risk building an unsatisfactory solution. Understanding the operational mode and how they map to requirements is fundamental.

Operational modes are:

• None—When None is selected, HA is disabled.

• Active/Standby Stateless—Active/Standby mode provides basic high availability with the configuration of two identical firewalls as a High Availability Pair. The Active unit handles all traffic, while the Standby unit shares its configuration settings and can take over at any time to provide continuous network connectivity if the Active unit stops working. By default, Active/Standby mode is stateless, meaning that network connections and VPN tunnels must be re-established after a failover.

• Active/Standby Stateful—Stateful Synchronization is enabled with the Active/Standby configuration to maintain session continuity during failover. In this mode, the dynamic state information is continuously synchronized between the Active and Standby units.

  Network connections and VPN tunnel information are continuously synchronized between the two units so that the Secondary can seamlessly assume all network responsibilities if the Primary firewall fails.

  When the Active unit encounters a fault condition, stateful failover occurs as the Standby firewall takes over the Active role with no interruptions to the existing network connections.

  Not all information is synchronized in a stateful configuration.

• Active/Active DPI—Active/Active Deep Packet Inspection (DPI) is a distinct High Availability operational mode in which both appliances participate concurrently in traffic processing. In this mode, the Active unit handles firewall, NAT, and session processing, while processor‑intensive DPI services—such as Intrusion Prevention (IPS), Gateway Anti‑Virus (GAV), and Anti‑Spyware—are offloaded to the peer appliance for parallel inspection.

  This DPI offload architecture improves overall performance by distributing inspection workloads across both security appliances while maintaining a single Active traffic‑forwarding role. If a failure occurs, the system transitions to a standard Active/Standby failover behavior until the affected appliance recovers.