High availability vs network mac/arp config

Question

Currently I test firewall HA settings and we observe some delays despite its active/passive config. Usually there should not be any interruption.Vendor explains this based on some configuration MAC/ARP table settings on the network devices the firewall attach to. There are two switches in front and behind the firewall.Is there a such setting that controls delays between firewall and switch? Thanks

Answer 1

Probably, there is no such feature on a switch that would cause a delay, not on commonly used products.

You might want to first understand how the HA mechanism of your FW product actually works (VRRP, HSRP, and similar protocols), and how exactly the feature is implemented. Even the same redundancy protocol can be configured in different flavours/scenarios, such as:

• triplet of IP addresses, one per node, one virtual; and the virt.IP shares the MAC address of the node it is currently on. Upon failover, the switches do not need to re-learn MAC adresses, but the neighboring IP systems will have to learn that the virt.IP has a changed MAC address (i.e.: they need to have their ARP caches updated). Usually, this is done by the newly-active node sendig G-ARPs from it's interface. This seems to be the default config style on many host based HA features, or Cisco's HSRP when used in burned-in-address mode.
• triplet of IP addresses, one per node, one virtual; and the virt.IP has it's own virtual MAC address. Upon failover, the neighboring IP systems do not need to change their ARP cache entries for the virt.IP, but the switches need to re-learn the virt.MAC's new location. Typical example: Cisco HSRP in default mode. Although not strictly necessary, the newly active node also sends a G-ARP; this supports the switches in re-learning and adjusting their CAM tables.
• one active IP, one standby IP, each with its own underlying MAC address. Upon failover, the IPs swap nodes, also changing the MAC address (requiring the nodes to send G-ARP to make the neighbors update their ARP cache). (Cisco PIX/ASA do this, if I remember correctly, unless configured with a virtual MAC).
• one virtual IP, one (virtual) MAC, but no addresses for the nodes (e.g. Fortigate Clusters). Upon failover, the IP and MAC address move to the other cluster node; switches must re-learn MAC addresses, while neighboring IP systems don't need to update their ARP caches.

Understandig which protocol and implementation and scenario your Firewall product actually uses will help to understand the issues observed, and in turn you'll know what options you have to mitigate.