NexusSec.A single firewall is a single point of failure: when it fails, reboots or needs a firmware upgrade, the office goes offline. A high-availability pair fixes that, provided it is designed properly.
How an HA pair works
The two firewalls keep their configuration in sync and, on most platforms, the state of active connections too. They watch each other over a dedicated heartbeat link. If the active unit fails, or a monitored interface or link goes down, the other unit takes over the same addresses and carries on.
Active-passive
One unit handles all traffic and the other stands by. Because either unit may have to carry everything, each one is sized for the full load. It is simple to understand, predictable when it fails over, and easier to troubleshoot. The cost is a second unit that mostly waits.
Active-active
Both units process traffic at the same time. It uses the capacity you paid for, but it is more complex, and asymmetric traffic flows can cause problems that are hard to diagnose. There is also a sizing trap: if you need both units' capacity to carry normal traffic, losing one leaves you overloaded. Size so that one unit could carry the load alone, and much of the benefit disappears for a typical office. Not every vendor or model supports active-active, and some features may behave differently in that mode, so check the vendor's documentation for your model.
What HA does not protect against
- A single internet link. Two firewalls behind one connection still go offline together when the link fails.
- A single switch or power feed. If both firewalls connect to the same switch or the same UPS, that is the new single point of failure.
- Configuration mistakes. Sync copies a bad rule to both units instantly. Configuration backups and change control still matter.
- Licensing gaps. Check how the vendor licenses the second unit, so that protection features keep working after a failover.
Design checklist
- Two identical models running the same firmware.
- A dedicated heartbeat link, ideally two, so one cable cannot cause a false failover.
- Each firewall connected to a different switch.
- Two internet links from different providers, ideally on different physical paths.
- Separate power circuits or UPS units for each firewall.
- Interface and link monitoring configured, so failover happens for the failures that matter.
- A planned failover test in a maintenance window, repeated regularly.
Firmware upgrades on a pair
Most platforms let you upgrade one unit at a time and fail over between them, which keeps downtime short. Still use a maintenance window, read the vendor's upgrade notes for HA pairs, and keep a configuration backup from before the upgrade.
When HA is worth it
If an hour offline stops billing, production or a customer-facing service, an HA pair usually pays for itself. It also matters at a head office that branches connect through. For a small site where a short outage is tolerable, a spare unit or a support contract with fast replacement may be enough. The firewall datasheet guide covers sizing, and our firewall deployment page covers how we design pairs.
