SonicWall High Availability
Increase Your Network Reliability

All SonicWall High Availability products can be found on their own individual product pages or purchase them below, more options can be found on individual product pages. Can't find the part you are looking for? Contact us today!

High Availability allows two identical SonicWall security appliances running SonicOS Enhanced to be configured to provide a reliable, continuous connection to the public Internet. One SonicWall device is configured as the Primary unit, and an identical SonicWall device is configured as the Backup unit. In the event of the failure of the Primary SonicWall, the Backup SonicWall takes over to secure a reliable connection between the protected network and the Internet. Two appliances configured in this way are also known as a High Availability Pair (HA Pair).

High Availability provides a way to share SonicWall licenses between two SonicWall security appliances when one is acting as a high availability system for the other. To use this feature, you must register the SonicWall appliances on MySonicWall as Associated Products. Both appliances must be the same SonicWall model.

Benefits of High Availability:

High Availability provides the following benefits:

• Increased network reliability – In a High Availability configuration, the Backup appliance assumes all network responsibilities when the Primary unit fails, ensuring a reliable connection between the protected network and the Internet.
• Cost-effectiveness – High Availability is a cost-effective option for deployments that provide high availability by using redundant SonicWall security appliances. You do not need to purchase a second set of licenses for the Backup unit in a High Availability Pair.
• Virtual MAC for reduced convergence time after failover – The Virtual MAC address setting allows the HA Pair to share the same MAC address, which dramatically reduces convergence time following a failover. Convergence time is the amount of time it takes for the devices in a network to adapt their routing tables to the changes introduced by high availability. By default, the Virtual MAC address is provided by the SonicWall firmware and is different from the physical MAC address of either the Primary or Backup appliances.

How High Availability Works:

High Availability requires one SonicWall device configured as the Primary SonicWall, and an identical SonicWall device configured as the Backup SonicWall. During normal operation, the Primary SonicWall is in an Active state and the Backup SonicWall in an Idle state. If the Primary device loses connectivity, the Backup SonicWall transitions to Active mode and assumes the configuration and role of Primary, including the interface IP addresses of the configured interfaces. After a failover to the Backup appliance, all the pre-existing network connections must be re-established, including the VPN tunnels that must be re-negotiated.

The failover applies to loss of functionality or network-layer connectivity on the Primary SonicWall. The failover to the Backup SonicWall occurs when critical services are affected, physical (or logical) link failure is detected on monitored interfaces, or when the Primary SonicWall loses power. The Primary and Backup SonicWall devices are currently only capable of performing Active/Idle High Availability or Active/Active UTM – complete Active/Active high availability is not supported at present.

For SonicWall appliances that support PortShield, High Availability requires that PortShield is disabled on all interfaces of both the Primary and Backup appliances prior to configuring the HA Pair. Besides disabling PortShield, SonicWall security appliance configuration is performed on only the Primary SonicWall, with no need to perform any configuration on the Backup SonicWall. The Backup SonicWall maintains a real-time mirrored configuration of the Primary SonicWall via an Ethernet link between the designated HA ports of the appliances. If the firmware configuration becomes corrupted on the Primary SonicWall, the Backup SonicWall automatically refreshes the Primary SonicWall with the last-known-good copy of the configuration preferences.

There are two types of synchronization for all configuration settings: incremental and complete. If the timestamps are in sync and a change is made on the Active unit, an incremental synchronization is pushed to the Idle unit. If the timestamps are out of sync and the Idle unit is available, a complete synchronization is pushed to the Idle unit. When incremental synchronization fails, a complete synchronization is automatically attempted.