Firewall Hot Standby Technologies · Topic 1 of 2
Hot Standby Fundamentals
Learn why firewalls need hot standby and how VRRP, VGMP priority and states, and HRP configuration and session backup keep traffic flowing on a failover.
- 5 min
- Firewalls are stateful, so hot standby must back up sessions as well as move the gateway address.
- VRRP provides the virtual IP address; the master sends advertisements to 224.0.0.18 every second by default.
- VGMP manages all VRRP groups of a firewall together; the higher VGMP priority becomes active.
What it is
Hot standby pairs two firewalls so that one takes over at once when the other fails, without breaking the connections already passing through. It removes the single point of failure at the network border.
A firewall is stateful: every permitted flow has an entry in its session table. A backup firewall that lacks those entries drops the return packets of existing connections, so hot standby must copy state, not just move a gateway address.
How it works
Why VRRP alone is not enough
VRRP (Virtual Router Redundancy Protocol) lets several devices share a virtual IP address that hosts use as their gateway. The master answers for it, and the backups take over when the master's advertisements stop.
| VRRP fact | Value |
|---|---|
| Group identifier | VRID, 1 to 255 |
| Virtual MAC address | 0000-5e00-01xx, where xx is the VRID |
| Advertisements | Sent by the master to 224.0.0.18, IP protocol number 112 |
| Default advertisement interval | 1 second |
| Default priority | 100 |
A firewall normally has a VRRP group on each side, one toward the inside and one toward the outside. If each group elected its master independently, a fault on one side would move only that side to the other firewall.
Outbound traffic would then pass FW1 while the replies arrive at FW2. FW2 has no session for the flow and drops the replies, which is called inconsistent forward and return paths.
VGMP: one state for the whole firewall
VGMP (VRRP Group Management Protocol) is Huawei's protocol that manages all VRRP groups of a firewall as a unit. The firewall's VGMP group decides whether the whole device is active or standby, and every VRRP group added to it follows that state.
| VGMP group state | Meaning |
|---|---|
| Initialize | Hot standby is not yet running |
| Active | This firewall forwards traffic |
| Standby | This firewall waits and receives backups |
| Load balance | Both firewalls forward traffic, in load sharing mode |
The two firewalls exchange VGMP packets over the heartbeat link and compare VGMP group priorities; the higher priority becomes active. The default priority is 45000 on many models, and it drops by 2 for each monitored interface or VRRP group that fails.
When the original active firewall recovers, its priority rises again. With preemption, it takes the active role back after a preemption delay, which gives HRP time to synchronize sessions first.
HRP: backing up configuration and state
HRP (Huawei Redundancy Protocol) copies data from the active firewall to the standby over the heartbeat link.
| What HRP backs up | Examples |
|---|---|
| Configuration | Security policies, NAT policies, address sets and other policy settings |
| State information | Session table entries, server map entries and similar dynamic tables |
Configuration is made on the active firewall, whose prompt shows HRP_M, and is copied to the standby, whose prompt shows HRP_S. Some settings are not backed up and must be configured on each firewall, including the HRP settings themselves, interface IP addresses and VRRP groups.
| Backup method | How it works |
|---|---|
| Automatic backup | The default; configuration changes are copied as they happen, and state such as sessions is synchronized regularly |
| Manual batch backup | The administrator triggers a full synchronization |
| Quick session backup | Sessions are copied immediately, needed when forward and return paths can differ, as in load sharing; enabled with hrp mirror session enable |
A worked example
FW1 (active) and FW2 (standby) connect a Trust LAN to the internet. Users use the VRRP virtual address 10.3.0.3 as their gateway, and FW1 owns it.
The upstream cable of FW1 is cut. The monitored interface fails, FW1's VGMP priority drops below FW2's, and FW2 becomes active for both VRRP groups. Because HRP had already copied the sessions, a large file download continues on FW2 without restarting.
How the exam asks about this
- "Which protocol backs up the session table from the active firewall to the standby firewall?" -> HRP.
- "Which protocol makes all VRRP groups on one firewall switch together?" -> VGMP.
- "What happens to the VGMP group priority when a monitored interface fails?" -> It decreases, by 2 for each failed interface, which can trigger a switchover.
What to remember for the exam
- Firewalls are stateful, so hot standby must back up sessions as well as move the gateway address.
- VRRP provides the virtual IP address; the master sends advertisements to 224.0.0.18 every second by default.
- VGMP manages all VRRP groups of a firewall together; the higher VGMP priority becomes active.
- HRP backs up configuration and state, such as sessions and server map entries, from active to standby over the heartbeat link.
- Interface IP addresses, VRRP settings and HRP settings are not backed up and must be configured on both firewalls.
Without VGMP, a fault on one side would move only one VRRP group, and traffic would leave through one firewall and return through the other that has no session for it.
Common mistakes
Thinking VRRP is enough for firewalls. VRRP moves the gateway address but not the session table, and it switches each group on its own.
Mixing up VGMP and HRP. VGMP elects the active firewall and controls VRRP states; HRP copies configuration and sessions.
Configuring policies on the standby. Backed up configuration is entered on the active firewall, the HRP_M prompt, and HRP copies it to the standby.
Check yourself
Why does a firewall pair need session backup while a router pair does not?
A firewall forwards return packets only if it has a matching session, so the new active firewall needs the sessions to keep existing connections alive.
What decides which firewall in a VGMP pair is active?
The VGMP group priority; the firewall with the higher priority becomes active, and faults lower the priority.
Name two items that HRP does not back up.
Interface IP addresses and VRRP group settings, which, like the HRP settings, are configured on each firewall.
Topic 1 of 2 in Firewall Hot Standby Technologies
Test yourself on Firewall Hot Standby Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.