Examkin

Question

Difficulty: MediumHigh Availability and Redundancy Concepts

A network administrator configures an active/passive firewall cluster to ensure high availability for an enterprise network. During a failover test, the passive firewall successfully assumes the active role, and newly initiated web traffic flows normally. However, all established, long-lived TCP sessions (such as SSH connections and database transactions) are immediately dropped, forcing users to reconnect. Which of the following is the most likely cause of this issue?

  1. Stateful session synchronization between the cluster nodes was not enabled.Answer
  2. B
    The client workstations were configured to use the primary node's physical IP address instead of the virtual IP address.
  3. C
    The secondary switch connected to the passive firewall was assigned a higher Spanning Tree Protocol priority value than the primary switch.
  4. D
    The DHCP relay agent interface on the internal gateway router was configured with an incorrect helper scope.

Answer

Stateful session synchronization between the cluster nodes was not enabled.
In a stateful high-availability deployment, active and standby nodes replicate connection tracking tables, NAT tables, and VPN state information across a dedicated heartbeat link. If state synchronization is missing or disabled (stateless failover), the standby unit has no record of established connections when it becomes active, forcing it to drop existing stateful TCP sessions while accepting new connections.

Step-by-Step Solution

1
Analyze the symptoms described in the scenario.
Takeover succeeded, and new traffic flows as expected, but active TCP connections dropped.
This indicates that Layer 2/3 IP failover (such as Virtual IP transfer) worked correctly, but state information was missing on the newly active node.
2
Differentiate between stateless and stateful high-availability failover.
Stateless failover moves IP addresses without sharing state tables; stateful failover continuously replicates state tables.
Without stateful session synchronization, the new active device treats incoming packets for pre-existing TCP connections as invalid (since they do not match any known session entry) and sends RST packets to reset them.
3
Select the configuration requirement that prevents session termination upon takeover.
Enabling stateful failover / state synchronization between HA nodes maintains active connection state across transitions.
This matches the exact root cause of dropped established connections during an otherwise successful failover.

Key Concept

Stateful vs. Stateless High Availability Failover
Rate this question

Topics

High Availability and Redundancy Concepts

More questions from this topic