Configure the primary Sophos Firewall

You must configure the auxiliary device before you can configure the primary device and enable HA.

1. Go to System services > High availability.

2. Specify the initial HA device state.

   Set the Initial device role to Primary.

3. Specify the HA configuration mode for the cluster.

   Option	Description
   Active–Active	The primary device receives all network traffic and load-balances the traffic using the auxiliary. Both the primary and auxiliary devices process traffic. The auxiliary takes over if a power, hardware, or software failure occurs on the primary.
   Active–Passive	The primary device processes all network traffic and the auxiliary remains in stand-by mode. The auxiliary becomes active and takes over only in case of a power, hardware, or software failure on the primary.

4. Select Interactive mode.

5. Assign a cluster ID, if required. You can use any value from 0 to 63.

   A cluster is a pair of devices operating in HA. Devices in the same cluster must share the same cluster ID.

   If you have multiple HA clusters, assign a different ID to each cluster.

   Note

   Sophos Firewall uses the cluster ID when it generates the virtual MAC address. For more information about the virtual MAC address, see HA architecture and design.

6. A passphrase is generated automatically. You can also change it manually.

   Note

   The devices in the cluster must have the same passphrase.

7. Select a dedicated HA link.

   The peers in an HA cluster continuously monitor the dedicated HA link and the interfaces configured to be monitored.

   Warning

   Don't use Port4 as the dedicated HA link on the following models:

   • XG 105 Rev.3
   • XG 115 Rev.3
   • XG 106

   Note

   The peer device must use the same HA link. Specify this port as the HA link port on the peer. For example, if you choose port E on the primary device, you must also choose port E on the auxiliary device.

   Note

   The IP address of the HA link for the peer device must be on the same subnet.

8. Select ports to be monitored for HA status. If any monitored port goes down, the device will leave the cluster and failover will take place.

   Note

   This feature is not supported in virtual security devices.

9. Specify Peer administration settings.

   Option	Description
   Interface	The port that is used for administration purposes on the auxiliary device.
   IPv4 address	The IPv4 address that provides access to the administration console of the auxiliary device.
   IPv6 address	The IPv6 address that provides access to the administration console of the auxiliary device.

   Note

   You can't enable HA if you turned on STP on a bridge interface.

   Note

   To access the peer administration IP address you must use a machine within the same LAN network, and the access must not be established through the primary device.

10. Specify the keepalive request interval in milliseconds. You can use a value from 250 to 500. Default is 250.

11. Specify the number of keepalive attempts. You can use a value from 16 to 24. Default is 16.

    Note

    You can't set the keepalive interval and keepalive attempts for devices in standalone and fault modes.

12. Select the checkbox if you want to use the hypervisor-assigned MAC address. This option is available only with virtual appliances.

    This removes the need to turn on promiscuous mode on the vSwitch.

13. Specify if the system should fallback to the primary device when it recovers.

    In the event of failover, traffic will be routed through the auxiliary. If you want this to automatically move back to the primary device when it recovers, select this option.

    Note

    If the device is in standalone or fault mode, this functionality will not be supported.

14. Click Initiate HA. The primary device pushes its configuration to the auxiliary.

When HA is active, the devices will synchronize automatically. To force the device to push configuration updates to the auxiliary, click Sync auxiliary.

If you have configured the device for Active–Passive mode, you can force the auxiliary to take over as the primary device by clicking Switch to passive device.