Hot Standby Overview

If only one FW is deployed at the egress of the network and a fault occurs on it, services on the entire network will be adversely affected. To improve network reliability, two FWs must be deployed and work in hot standby mode.

Hot standby requires two FWs with the same hardware and software configurations. The two FWs are connected through an independent link, which is usually called a heartbeat link. The two FWs learn the health status of the each other and back up configurations and entries (such as session table entries and IPSec SAs) to each other through the heartbeat link. If a FW fails, services can be smoothly switched over to another FW to ensure that services are not interrupted.

Figure 1 Typical hot standby networking