Describes Hypershield HA requirements, connectivity, synchronization, supported peer configurations, and limitations for maintaining stateful traffic inspection during switch or DPU failures.
The High Availability (HA) feature ensures that the services remain available for both bridged and routed traffic during switch or DPU failure or outage. High Availability is achieved by enabling redundant paths for traffic flows and synchronizing the flow state across these paths, which is critical for stateful services.
HA peers
HA peering requires identical hardware platforms running the same software version. HA peering between two different hardware platforms is not supported, for example, if one Smart Switch is N9324C-SE1U and the other Smart Switch is N9348Y2C6D-SE1U.
The HA infrastructure ensures that the service firewall state is synchronized between configured peers. If the firewall service is not ready or becomes unavailable on a switch, HA disables the network paths through that switch and directs traffic to the other available peer. When two switches are configured for HA (Active/Active HA model), the service firewall state is synchronized between the two peering switches. Currently, only two smart switches can be configured as HA peers.
Due to VXLAN headers and the MAC-IP-UDP encapsulation for inline flow sync of traffic between HA peers, a host should not send jumbo frames larger than 9216 - 10B (for HA) - 30B (for macsec) = 9174 B of 9134B in case of VXLAN + MACsec. Effectively, the maximum packet size that is currently supported is 9000 bytes.
Connectivity between HA peers
HA communication requires Layer 3 connectivity with IPv4 addresses in the default VRF which you must provide between the two switches that make the HA pair. The security subsystem implements stateful inspection through flow and state synchronization.
Layer 3 connectivity between HA peers is required to carry:
-
control plane traffic between the Hypershield Agents on the HA peers, for keepalives and state information exchange
-
control plane traffic between the DPU pairs (DPU1 – DPUn) of the HA peers, for keepalives and flow state sync
-
data traffic for inflow flow-sync for flow learns, and
-
data traffic for inline flow-state sync for stateful traffic inspection.
The HA connectivity can be established using dedicated or shared links between the HA peers:
-
Dedicated Port Channel: A specific port channel set up exclusively for the HA synchronization between peers.
-
Shared Port Channel: Utilizes an existing port channel, such as a vPC peer link, already connecting the peers.
The links should be at least 25G and directly connected, but in most deployments the minimum bandwidth may be 2 x 400G unless traffic flows between the Smart Switches are symmetric. The port channel provides link redundancy. SVIs over Layer 2 port channels can also be used to establish this connectivity.
Guidelines and limitations
-
HA connectivity over routed or VXLAN fabrics is not supported in 10.6(3s)F.
-
NTP or PTP must be configured and be in sync between the two HA switches so that the time and flows are synchronized on both the switches
-
For HA to work correctly, the DPU load-balancing configuration must be identical on both Smart Switches in the same HA pair, and the service VRF and service VLAN configuration must be identical on both devices.
-
Even if HA is configured, temporary traffic interruptions might occur for asymmetric flows if there is a mismatch in policy versions, or flow-sync is incomplete or in-progress. You may also experience temporary traffic interruptions when traffic deflections occur in the network.
-
Interruptions can be observed while establishing or recovering HA connectivity between switches with active firewall services.
Loss of connectivity between HA peers
If HA peers lose connectivity (a split-brain scenario), both switches disable the traffic deflection mechanism and operate as standalone firewall services. This state can result in two types of traffic issues:
-
Dropped Traffic: Traffic arriving at a HA peer that is not ready can be dropped.
-
Asymmetric Flow Failures: Independent inspection by both peers may lead to asymmetric flow failures.