HA Firewall Pair Best Practices

Overview

High Availability (HA) firewall deployments improve network resiliency by providing automatic failover when the primary firewall becomes unavailable. Regardless of the firewall vendor you use, following established HA deployment practices helps ensure a reliable implementation and successful monitoring.

Important

This article provides vendor-agnostic guidance for deploying HA pairs of firewalls.

Every firewall vendor implements HA differently, including synchronization, failover behavior, management interfaces, and Out-of-Band (OOB) management. Always validate your deployment against your firewall vendor's documentation before making configuration changes. Vendor documentation is the authoritative source for your platform.

Prerequisites

Before configuring HA, ensure you have:

• Two supported firewall appliances
• Required HA licensing (if applicable)
• Three separate networks:
  • Production/Data
  • HA synchronization
  • Out-of-Band (OOB) management
• Administrative access to both appliances
• Required network cabling

Configure the firewall pair

A typical deployment includes:

1. Rack and cable both appliances.
2. Configure the primary firewall.
3. Configure production interfaces.
4. Configure the HA synchronization link.
5. Configure Active/Passive or Active/Active mode (depending on vendor support).
6. Configure session synchronization where supported.

Refer to your firewall vendor's documentation for the exact HA configuration steps.

Configure Out-of-Band management

Configure dedicated management interfaces on both firewall appliances.

Best practices include:

• Assign each firewall its own management IP address.
• Connect both management interfaces to the OOB management network.
• Restrict management access to trusted management networks only.

Dedicated management connectivity allows monitoring platforms such as Auvik to communicate with each firewall independently.

Validate the deployment

Before placing the HA pair into production:

• Verify synchronization is healthy.
• Perform a failover test.
• Confirm traffic continues to pass normally.
• Restore the original primary firewall.
• Verify successful failback.

Next steps

After your HA deployment has been validated, continue to Configure Fortinet HA Pairs for Monitoring in Auvik if you're deploying FortiGate firewalls, or consult your firewall vendor's documentation for product-specific monitoring recommendations.