Convert XGS 4500 HA from Active-Passive to Active-Active

Hi Fizzle,
recreating HA is not very complicated.
you remove the slave from ha/remove the HA config an get a standalone device. now you can configure a new HA as active-active.
but i think you didn#t get more redundancy with this action.
active-activ ha is for load sharing primary ... as i know.
you should not get additional wiring options .... please correct me if that is the case ...
be aware, with active-active ha, you need all licenses twice.

Maybe you would like to share your ideas about cabling with us?

Hi Fizzle,
recreating HA is not very complicated.
you remove the slave from ha/remove the HA config an get a standalone device. now you can configure a new HA as active-active.
but i think you didn#t get more redundancy with this action.
active-activ ha is for load sharing primary ... as i know.
you should not get additional wiring options .... please correct me if that is the case ...
be aware, with active-active ha, you need all licenses twice.

Maybe you would like to share your ideas about cabling with us?

SFOS HA is a full load balancing option in terms of offloading traffic. Your Primary will be still the one appliance accepting all traffic. 

See: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/AboutHA/HAArchitecture/index.html#virtual-mac-address 

The Primary will get all requests in both scenarios.

A-A means, you will have to buy another license for your cluster. Is your current solution out of capacity? 

Ahhh, this is what I was missing. I'm not out of capacity.  My HA cores can send data simultaneously to whatever they are connected to. My goal was to connect everything together in redundant fashion so there would be no downtime at all in the event of a firewall or core switch going down.  In an A-P configuration the firewalls still have a short amount of downtime as everything is migrated over to the secondary - which is what I was hoping to avoid with the setup I had in mind.

You will still have a break while the old connections time out and reestablish through the alternate firewall.

ian

some/most connections should be statefull migrated to other appliance while failover.
we onle have some seconds while ip addresses switching to the other device

The stateful migration will happen in a A/P pair but not in a A/A pair because the second firewall would not know about the original connection.

Ian

OK, thanks. That was new to me. You're right.
Those who can read have a clear advantage