I participated in a discussion about a High Availability feature on Cisco ASA and FortiGate. We were talking about active-active, active-passive and active-standby modes. What was funny, we talked about the same features using different names. Yes, Cisco and Fortinet, they use different names for the same features. Let me explain it to avoid similar misunderstanding.
1) Cisco ASA
They are two modes available:
a) active/standby - the method is available only in standalone mode. The concept is simple: you have two devices: a primary and a secondary. When it possible the primary is an active device and the secondary a standby. Only one device (active) processes traffic and the standby waits passively, monitoring the status of the active one. When failure happens (failure of the device, an interface, etc.), it triggers a fail-over and the secondary (standby) becomes the active one (secondary/active).
b) active/active - this mode is only available in multi-context mode. You have to decide which context should be an active on which unit. The concept is to load the traffic more or less equally on both units: the primary and the secondary. When one unit is not available, all contexts are in the active mode on the working one.
2) FortiGate
Fortinet proposes more scenarios. Let's see how they work.
a) active/passive - this mode works pretty much the same as the active/standby on Cisco ASA. One device is actively processing the traffic and the passive one only monitors the active one.When the passive stops receiving heartbeats from the active unit, it takes over the active role.
b) active/active- Fortigate supports up to four units and one unit is a primary one. It receives all traffic and then it decides which unit will process a particular session. When for example unit #3 is down, the primary one stops off-loading sessions to this one. When something happens to the active/primary one, the rest of active units elect a new active/primary one.
c) active/passive - virtual clustering - this one is very often mixed with active/active (by Cisco engineers). This scenario is limited to two physical units and it works very similar to active/active Cisco ASA. You set a priority on each VDOM to decide which VDOM should be active on the Unit #1 and #2.
Glossary:
Security Context (Cisco ASA) and VDOM (Fortinet) - virtual instance on the physical device. You can have many of them and each acts as an independent device with own: operational mode, IP addressing, interfaces, administrators, policies, routing, etc.
Resources:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/general/asa-910-general-config/ha-failover.html#ID-2107-00000b19
https://docs.fortinet.com/d/fortigate-ha-60
1) Cisco ASA
They are two modes available:
a) active/standby - the method is available only in standalone mode. The concept is simple: you have two devices: a primary and a secondary. When it possible the primary is an active device and the secondary a standby. Only one device (active) processes traffic and the standby waits passively, monitoring the status of the active one. When failure happens (failure of the device, an interface, etc.), it triggers a fail-over and the secondary (standby) becomes the active one (secondary/active).
b) active/active - this mode is only available in multi-context mode. You have to decide which context should be an active on which unit. The concept is to load the traffic more or less equally on both units: the primary and the secondary. When one unit is not available, all contexts are in the active mode on the working one.
2) FortiGate
Fortinet proposes more scenarios. Let's see how they work.
a) active/passive - this mode works pretty much the same as the active/standby on Cisco ASA. One device is actively processing the traffic and the passive one only monitors the active one.When the passive stops receiving heartbeats from the active unit, it takes over the active role.
b) active/active- Fortigate supports up to four units and one unit is a primary one. It receives all traffic and then it decides which unit will process a particular session. When for example unit #3 is down, the primary one stops off-loading sessions to this one. When something happens to the active/primary one, the rest of active units elect a new active/primary one.
c) active/passive - virtual clustering - this one is very often mixed with active/active (by Cisco engineers). This scenario is limited to two physical units and it works very similar to active/active Cisco ASA. You set a priority on each VDOM to decide which VDOM should be active on the Unit #1 and #2.
Glossary:
Security Context (Cisco ASA) and VDOM (Fortinet) - virtual instance on the physical device. You can have many of them and each acts as an independent device with own: operational mode, IP addressing, interfaces, administrators, policies, routing, etc.
Resources:
https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/configuration/general/asa-910-general-config/ha-failover.html#ID-2107-00000b19
https://docs.fortinet.com/d/fortigate-ha-60
Comments
Post a Comment