How an active/standby pair works
- Virtual addresses. The addresses your clients and the internet use (the uplink address, public addresses of your servers, the internal gateway addresses) belong to the pair, not to one machine. Only the active node holds them; each node also keeps an address of its own on every link.
- All or nothing. A node is active on every network segment or on none, so traffic never enters through one node and leaves through the other.
- A dedicated sync link. A direct cable or a private VLAN between the two nodes carries an authenticated heartbeat, the connection-state sync and the configuration sync. The heartbeat decides the roles while it is fresh, so forged announcements on other links cannot move the active role.
- Health tracking. Links, internet uplink health checks, the firewall policy, intrusion prevention and the peer heartbeat are monitored. If a tracked item fails, the node steps down and the peer takes over.
What happens during a failover
- The standby stops hearing the active node (after a few missed announcements), or the active node steps down because it is faulty or in maintenance.
- The standby takes over the virtual addresses and announces them to the network.
- It starts the services that run only on the active node: the DHCP server and the VPN tunnels and servers.
- Connections known through connection-state sync continue; others are reset or re-established by the clients.
- When the old active node returns, it starts as standby. It takes the role back only if you enable preemption and give it the higher priority.
Every role change is listed in the console, and a change decided without a fresh heartbeat raises a high-severity event.
Configuration sync
You make changes on the primary console; it pushes its confirmed configuration to the standby, automatically after every confirmed change or on demand. The firewall policy, the network configuration, intrusion detection and prevention, threat feeds and the shared high availability settings are synchronised; user accounts only if you opt in on both nodes. Each node keeps its own interface addresses, host name and priority. A comparison view shows which sections are in sync.
Policy and network changes on the standby use the same confirmation timer as everywhere else: if the primary's confirmation does not arrive, the standby rolls the change back by itself.
Planning a pair
- Two machines with the same VYREON release and the same port layout.
- A dedicated link between them for the sync link: a point-to-point cable or VLAN, never a shared segment.
- A static address of its own for each node on every segment that carries a virtual address, plus the virtual addresses themselves.
- VPN clients and remote sites must use a virtual address (or a DNS name pointing to it) as their endpoint. See the site-to-site VPN guide.
- For licensing, a pair counts as two gateways.
Setting it up
The High availability page walks you through four steps on both nodes: the sync link, pairing the nodes, the virtual addresses and failover settings, and enabling the pair. Setting up or changing high availability needs a licence that includes it; failover of a configured pair is never licence-gated.