As shown in the figure, the firewall load balancing network is used, and it is found that packet loss sometimes occurs in business traffic. Which of the following may cause this to occur? (Multiple…

Question

Exhibit

Options

• AHRP is not configured
• BSession fast backup is not configured
• COnly one VRRP group is configured
• DHeartbeat port failure

• A
  85% (33)
• C
  15% (6)

Explanation

In a firewall load balancing setup, both firewalls actively handle traffic, so they must share session state - without it, a return packet arriving at the firewall that never saw the original request will be dropped. A (HRP not configured) and B (session fast backup not configured) are correct because HRP is the protocol that synchronizes session tables between firewalls, and fast backup is the mechanism that actually replicates sessions in near-real-time; missing either means one firewall is blind to sessions established by the other. D (heartbeat port failure) is correct because the heartbeat link is the physical channel HRP uses to exchange state - if it fails, synchronization breaks even if HRP is configured, with the same packet-drop result.

C is wrong because having only one VRRP group simply means traffic isn't actively load-balanced across both firewalls (one stays standby), which reduces performance but does not itself cause packet loss - there's no session mismatch if only one firewall is forwarding.

Memory tip: Think of it as a three-legged stool - HRP (the protocol), fast backup (the sync job), and the heartbeat port (the wire). Knock out any one leg and session synchronization collapses, dropping packets. Option C is a red herring about distribution, not synchronization.

No community discussion yet for this question.