Firewall Failover and Synchronization

In this lesson, you will learn how to maintain seamless network connectivity during a firewall hardware failure by synchronizing connection tracking states across a high-availability cluster.

The Problem: Stateless vs. Stateful Failover

In a standard stateful firewall (using netfilter or nftables), the kernel keeps a "Connection Tracking" (conntrack) table to remember the state of active flows—like whether a TCP handshake was completed or if a packet is part of an established stream.

If your primary firewall dies, a backup unit can immediately take over the IP address via protocols like VRRP (Keepalived). However, without synchronization, the backup firewall has an empty conntrack table. It will see an incoming packet for an ongoing connection, assume it is an invalid "out-of-state" packet, and drop it. This forces users to reconnect, breaking sensitive sessions like SSH, VPNs, or database transactions.

The Solution: State Synchronization

To prevent this, we use synchronization tools—most commonly conntrackd—to replicate the conntrack table from the active node to the passive node in near real-time.

1. Internal Sync Link: You dedicate a physical or virtual interface as a heartbeat/sync channel between the nodes.
2. Synchronization Protocol: conntrackd listens to the kernel’s netlink events. When a new flow is created or updated on the primary node, the kernel notifies conntrackd, which pushes that state over the sync link.
3. Flow Injection: The secondary node receives these updates and "injects" them into its own kernel conntrack table using the netlink interface.

By the time the secondary node assumes the primary role, its conntrack table is already "warmed up." It recognizes the ongoing traffic as legitimate, and the transition remains invisible to the end user.

Configuration Snippet

On a Linux cluster using conntrackd, you typically define the synchronization channel in conntrackd.conf:

Sync {
    Mode FTFW {
        DisableExternalInterface on
    }
    UDP {
        IPv4_address 192.168.100.1 # Sync interface IP
        IPv4_Destination_Address 192.168.100.2
        Port 3780
    }
}

This ensures that the secondary node is always "in the loop" regarding the state of the network, transforming a simple redundancy setup into a true high-availability service.

Key Takeaway: Firewall synchronization ensures that active connection states are replicated to standby nodes, allowing for seamless traffic failover without dropping existing network sessions.