SonicOS 8 High Availability

Technical Documentation>  Monitoring High Availability>  Verifying Active/Active DPI Traffic Offloading
Table of Contents

Verifying Active/Active DPI Traffic Offloading

Use the CLI of the Standby firewall to verify that it processes offloaded DPI traffic. This test uses the DEVICE | High Availability > Advanced page, which differs from the monitoring settings on this page.

To verify Active/Active DPI offloading

  1. Verify that the HA Mode field on DEVICE | High Availability > Status shows Active/Active DPI and that the Active/Active DPI link is connected.

  2. Verify that Gateway Anti-Virus, Gateway Anti-Spyware, IPS, Application Control, or Capture ATP is enabled and applied to the test traffic. For an HTTPS test, enable DPI-SSL. For an SSH test, enable DPI-SSH.

  3. On the active appliance, navigate to DEVICE | High Availability > Advanced and set:

    1. Active/Active DPI Traffic Offload %: 100%

    2. Active/Active DPI CPU Threshold %: 0%

  4. Click Accept.

    These settings send all eligible DPI traffic to the Standby firewall and can increase its load. Run this test during a maintenance window.

  5. Access the CLI of the Standby firewall. In the normal Primary Active configuration, this is the Secondary firewall. Use the management IP address of the Secondary firewall, which you set on DEVICE | High Availability > Monitoring.

  6. Run the following command to establish a baseline. Note the DPI packet-processing counters in the output.

    show tech-support-report active-utm

  7. Generate eligible HTTPS or SSH traffic from a LAN client to a WAN destination. For example, download a large file (about 100 MB or more) over HTTPS. Eligible traffic is TCP traffic that uses a supported protocol and that a DPI security service inspects.

  8. While the traffic flows, run the command again. Compare the DPI packet-processing counters with the baseline. Increased counters confirm that the Standby firewall handles DPI packets.

  9. After the test, restore the offload percentage and CPU threshold to the values that the deployment requires. The defaults are 60% for both settings. Click Accept to save the values.

    Verify offloading with the reported DPI packet-processing activity. Do not use the dashboard bandwidth reading of the Standby firewall as the only verification method.