Firewall High Availability: 7 Proven Rules for a Failover That Works

Last updated: October 16, 2026 · By the Jazz Cyber Shield team

Firewall high availability means running two identical firewalls as one logical unit, so that when the active box fails, the standby takes over the same IP addresses and keeps your office online. This guide explains how it works on FortiGate, SonicWall and WatchGuard, what each brand requires you to license, and the seven design rules that decide whether a failover is clean or chaotic.

Jazz Cyber Shield is a US-based reseller of networking and cybersecurity hardware. We quote, configure and ship firewall pairs for offices, clinics, warehouses and multi-site businesses, and the questions in this guide are the ones buyers ask us before they order a second unit.

What is firewall high availability?

Firewall high availability is a design in which two firewalls share one configuration and one set of virtual addresses, so devices on your network never notice which physical box is forwarding their traffic. If the active unit loses power, crashes or loses a monitored link, the partner takes over.

Every vendor uses its own name for firewall high availability. Fortinet calls it the FortiGate Clustering Protocol (FGCP). SonicWall calls the two units an HA Pair, with a Primary and a Secondary. WatchGuard calls it FireCluster. The mechanics are similar across all three:

• A heartbeat link. A dedicated cable between the two units carries health checks and configuration sync. Fortinet’s cookbook states that FGCP synchronization runs over the heartbeat link on TCP and UDP port 703.
• Configuration sync. You manage the primary, and it pushes changes to its partner.
• Virtual addresses. Your LAN gateway and WAN IP belong to the cluster, not to one box, so they move with the active role.
• Monitoring. Each unit watches its partner and selected interfaces, and triggers failover when something breaks.

What firewall high availability does not do is protect you from a misconfiguration. Because the configuration is synchronized, a bad rule pushed to the primary lands on the secondary seconds later. Firewall high availability protects against hardware and link failure, not against human error, so backups and change control still matter.

Active-passive vs active-active: which mode should you run?

For most small and mid-sized offices, active-passive is the better choice. It is simpler to troubleshoot, it works with dynamic internet circuits on more platforms, and on WatchGuard it can lower your subscription bill.

In active-passive mode, one unit handles all traffic while the other waits. In active-active mode, both units process traffic at the same time. WatchGuard’s documentation describes active/active traffic being distributed with a round-robin or least-connections algorithm, and notes that return traffic must come back through the same member that handled the outbound packet.

Active-active sounds like double the performance, but plan as if it is not. If one unit fails, the survivor must carry the full load alone, so each box still has to be sized for 100% of your traffic. The real benefit is modest load sharing, and the cost is extra design work. WatchGuard, for example, supports active/active only in mixed routing mode, requires static external IP addresses (no DHCP or PPPoE), and needs switches configured for multicast MAC addresses.

Does your business actually need firewall high availability?

You need one when an hour without internet or VPN costs more than a second appliance and its support contract. If staff can work from phones for a morning while a replacement ships, a single firewall with a good backup may be enough.

We ask buyers three questions before quoting firewall high availability:

• What stops when the firewall stops? Cloud phone systems, card payments, EHR access, site-to-site VPNs and remote workers all depend on that one box.
• How fast can you get a replacement? Even with advance replacement support, you are waiting on shipping, then restoring the configuration. HA turns that wait into an automatic switchover.
• Is the rest of the path redundant? A firewall pair behind one switch and one internet circuit still has single points of failure.

Here is how we usually see the decision land:

• 10-person office with cloud apps: often fine with one firewall, a saved configuration and next-business-day hardware support.
• 25-person medical or dental practice: a strong case for firewall high availability, because scheduling, imaging and payments stop when the internet stops.
• Headquarters with branch VPNs: nearly always worth it, since one failure takes every branch offline at once.
• Warehouse running a WMS or VoIP: worth it when scanners, label printers and phones depend on a cloud platform.

If you want to put a number on it, our guide to the real cost of network downtime for business revenue walks through the math.

How is firewall high availability licensed on each brand?

Licensing is where firewall high availability budgets go wrong, because the three brands handle the second unit very differently. FortiGate licenses each member, SonicWall shares the primary’s licences with a dedicated HA unit, and WatchGuard’s rules depend on the mode you choose.

FortiGate: does the second unit need its own FortiGuard licence?

Yes. Fortinet’s FGCP cookbook states that most subscriptions and licenses are not synchronized, so each FortiGate in the cluster must be licensed individually.

In a Fortinet Community thread on HA licensing, Fortinet staff said both nodes should carry the same licences, and explained that when they differ, the cluster applies the lower level. In practice, if you buy a UTP bundle for the primary and plain hardware for the secondary, you can lose those services across the cluster. Budget two matching bundles. Our Fortinet FortiGate firewalls range lets you quote both units together.

SonicWall: what does the HA unit actually include?

SonicWall sells a dedicated High Availability unit that leans on the primary’s subscriptions. Its HA FAQ says licences on the primary are shared with the secondary, and that HA appliances cannot accept their own licensing.

The catch is stateful failover. SonicWall’s SonicOS 8 HA guide lists Active/Standby as included on every TZ, NSa and NSsp platform it covers, but Stateful HA is optional, with extra licensing, on the TZ80, TZ270, TZ370, TZ470, TZ570 and TZ670, plus the NSa 2700 and NSa 3700. Without it, SonicWall notes that connections and VPN tunnels must be re-established by the secondary before takeover completes. Browse SonicWall TZ and NSa firewalls for matching pairs.

WatchGuard: can one Firebox carry the security suite?

In active/passive mode, yes. WatchGuard’s FireCluster requirements state that only one member needs a Basic, Prime or Total Security Suite, while the other can run Standard Support. Both members still need an active Support subscription.

Active/active changes the rule: both members need the same security suite. That makes active/passive the budget-friendly default on WatchGuard Firebox firewalls, and one more reason we rarely recommend active/active to smaller offices.

7 proven rules for a firewall high availability design that works

A clean failover depends less on the firewall and more on everything around it. These are the rules we apply on every firewall high availability quote.

Rule 1: Buy two identical units on day one

Every vendor in this guide requires the same model and the same firmware. WatchGuard also requires identical interface modules in the same slots, and Fortinet requires matching hardware such as disk count. Ordering the pair together avoids mismatched hardware revisions and makes upgrades simpler.

Rule 2: Size each unit for the whole load

In a firewall high availability pair, do not split your throughput target across two boxes. After a failure, one unit carries everything, with all security services turned on. Use threat protection or UTM throughput, not raw firewall throughput, as explained in our guide to firewall throughput vs bandwidth sizing.

Rule 3: Give the heartbeat its own cable, ideally two

The heartbeat is how each unit knows its partner is alive. SonicWall recommends connecting the dedicated HA ports directly. Fortinet recommends two back-to-back heartbeat links. WatchGuard strongly recommends a direct primary cluster link, plus an optional backup link on a different subnet.

Rule 4: Remove the single switch

Two firewalls plugged into one switch just moves the single point of failure. WatchGuard notes you need a network switch for each enabled trusted, optional, custom or external interface, and both members must reach those segments. Pair your firewalls with stackable or redundant managed network switches so a switch failure does not end the day.

Rule 5: Check what your internet circuit allows

Firewall high availability often needs more public IPs than a single firewall does. SonicWall’s prerequisites call for a static WAN virtual IP and say dynamic ISP addressing is not supported for HA. WatchGuard active/active also rules out DHCP and PPPoE on external interfaces. Confirm your ISP handoff before you order.

Rule 6: Decide in advance which sessions must survive

Not every connection survives a failover. WatchGuard keeps packet filter connections, branch office VPN tunnels and user sessions, but proxy and Mobile VPN connections may drop. On SonicWall TZ models, keeping sessions alive requires the Stateful HA licence. If VoIP calls or long file transfers must survive, plan for it.

Rule 7: Match licences and renewal dates

Firewall high availability fails quietly when one unit’s subscription lapses. On FortiGate, mismatched licences can drop the cluster to the lower level. Align both renewal dates, register both serial numbers, and on SonicWall link the pair in MySonicWall before you connect them physically, as SonicWall’s prerequisites require.

How do you deploy firewall high availability step by step?

Plan addressing and cabling on paper first, then build the primary, then join the secondary. The order matters, because most platforms expect the primary to be configured and online before the partner joins.

1. Confirm compatibility. Same model, same firmware, and for WatchGuard, a model on the FireCluster supported list.
2. Register both units. Add both serial numbers to your vendor portal and associate them as a pair where the vendor requires it.
3. Plan IP addresses. SonicWall needs three LAN addresses: the LAN virtual IP plus a management IP for each unit. WatchGuard suggests APIPA (169.254.x.x) addresses for the cluster interfaces.
4. Cable the heartbeat. Run a direct cable between the dedicated HA or cluster ports, and add a second link where supported.
5. Cable LAN and WAN. Connect each unit’s matching ports to the same switches, so either box can take over every segment.
6. Build the primary. Finish interfaces, policies, VPNs and security services on the primary.
7. Join the secondary. Enable HA on both units and let the primary sync its configuration across.
8. Verify status. Check the HA dashboard for synchronized configuration and matching licences before you test failover.

If your switches run spanning tree, SonicWall advises adjusting port link activation time, for example enabling PortFast on Cisco Catalyst switches. Skipping this can make a healthy failover look like an outage while switch ports converge.

How should you test firewall high availability failover?

Test during a planned maintenance window, with someone on site and a rollback plan. A firewall high availability pair that has never been tested is a guess, not a safeguard.

• Pull power on the active unit. Confirm the standby takes over and that users can still browse.
• Unplug a monitored interface. Check that link loss triggers failover the way you configured it.
• Watch your critical apps. Keep a VoIP call, a VPN tunnel and a remote desktop session open, and note which survive.
• Restore and fail back. Make sure the pair returns to a healthy, synchronized state.
• Write it down. Record what dropped, how long recovery took on your network, and what you changed.

Repeat the test after major firmware upgrades. Upgrading an HA pair has its own procedure on each platform, so read the vendor’s upgrade notes before you start.

Common firewall high availability mistakes we see

Most failed firewall high availability projects trace back to planning, not hardware. These are the mistakes we see most often:

• Buying one bundle and one bare unit on FortiGate. The cluster can fall back to the lower licence level.
• Assuming SonicWall failover keeps sessions. On TZ models, that needs the optional Stateful HA licence.
• Choosing active-active for speed. It adds design work while each unit still needs full-load sizing.
• Running the heartbeat through a busy shared switch. A flapping heartbeat can cause both units to fight for the active role.
• Using one WAN switch with no redundancy. The firewalls are redundant; the path is not.
• Never testing. The first failover should not happen during a real outage.

Frequently asked questions

Next steps: choosing hardware for your pair

Firewall high availability works best when it is planned as one project: two identical firewalls, matching licences, redundant switching and an internet handoff that supports it. Getting those four pieces right on the first order saves rework later.

Start by comparing models in our business firewalls for every office size collection, then pick the brand that fits your licensing budget. If you already own one unit, send us its model and current subscriptions and we will match the second.

Sources

• Fortinet: Introduction to the FGCP cluster (FortiOS cookbook)
• Fortinet Community: Licensing HA for FortiGate
• SonicWall: SonicOS 8 HA supported platforms and licensing
• SonicWall: High Availability (HA) FAQ
• SonicWall: Stateful and non-stateful HA prerequisites
• WatchGuard: Before you configure a FireCluster
• WatchGuard: About FireCluster