Cisco WSA HA

[Mandeep singh5]

Hello All,

I know that in Cisco WSA, we can configure high availability with CARP protocol. But I need to confirm that in Active Standby HA of Cisco WSA is it stateful failover. Which means that If I confiugred HA in WSA and active appliance goes down then does standby appliance have the information of active connections?

Please clear my doubt on this, Thanks to everyone in advance.

@Websecurity @WSA @proxy 

[balaji.bandi]

Personally i would not setup WSA as active / standby in this case you just wasting money (personally)

Rather i setup LB traffic between WSA and LB can take care when the one of the WSA fails other one keep processing the traffic, in this case its value for money - and you using both the WSA all time.

below methods if you looking LB

1. LB ( any LB should able to Loadbalance the Traffic)

2. PAC to WPAD to split the load between WSA

3. WCCP

As per your question yes - CARP

Configuring Failover Groups for High Availability

Using the Common Address Redundancy Protocol (CARP), the Web Security Appliance enable multiple hosts on your network to share an IP address, providing IP redundancy to ensure high availability of services provided by those hosts.

Failover is available only for the proxy service. The proxy automatically binds to the failover interface when the failover group is created. Thus, if the proxy goes down for any reason, failover is triggered.

In CARP, there are three states for a host:

• primary - there can only be one primary host in each failover group

• backup

• init

[Milos_Jovanovic · Accepted solution]

Hi @Mandeep singh5,

No, it is not stateful failover, like on FW. But, it also doesn't need to be. Given that HTTP is transactional based, once user loads page, that is it, transaction is over, so no need to keep session state tracking like on FW. In case of failure, user will open new page, and it would flow the same way.

What does get affected is if failover happens in the middle of transaction, then user might get page loaded partially. However, in that case, user would simply reload page, and everything would be loaded again. Also, authentication cache gets affected, and user might need to be authenticated again. But again, given that for authentication transparent mechanisms are mof often used (like Kerberos or NTLM), user is unaware of this, and everything runs smoothly.

Kind regards,

Milos