Active/Standby Pair - How does traffic flow

[GRANT3779]

Hi All,

If we have an active/standby in transparent mode setup similar to the attached diagram (the 2 FW have a direct cable also for the heartbeat). When one of the FW is active - does spanning tree block a port so that traffic only goes through one FW for example?

I have a setup similar to the attached, bridging VLANs through the FW. 

If I have traffic coming in from a PC on the LAN, it will hit its DG/SVI on the Core device and depending on the routing table the Core Device will ARP for the WAN1 or WAN2 MAC - Is one of the FW ports LAN side in some sort of blocking state so that the ARP Request/Reply only goes through the active one? trying to understand how the traffic knows to only go through the active FW when in transparent mode. From what I can see, no ports are being blocked.

Thanks

[Jon Marshall · Accepted solution]

My understanding has always been that the standby firewall simply doesn't pass traffic so you can't a get a loop.

In your case when the core device sends an arp for the WAN IP (whichever it is) the broadcast will only be passed by the active firewall so all the mac addresses will only be seen on that link.

So as far as I know STP does not need to block any ports.

But you should use STP just in case both firewalls become active.

Jon

[GRANT3779]

Hi Jon,

Thanks for the info, so would it be safe to say that in the case above - when the Core sends ARP for the WAN it would go out to both FW but only the active would process it (and same for traffic going in opposite direction - from WAN to Core)

[Jon Marshall]

If you have no blocking ports on the switches then yes I believe that is exactly what happens.

Jon