In a firewall dual-machine hot backup scenario, which of the following types of packets require security policy configuration?

Question

Options

• AConfiguration and table entry backup messages
• BFree ARP message
• CHeartbeat link detection message
• DDHCP message

• A
  6% (1)
• B
  12% (2)
• C
  6% (1)
• D
  76% (13)

Explanation

In a dual-machine hot backup (HA) scenario, DHCP messages are actual service traffic that passes through the firewall as part of normal network operations - unlike the other options, they are not internal HA mechanism messages, so they must be explicitly permitted or denied by a configured security policy.

Why the distractors are wrong:

• A (Configuration and table entry backup): These messages synchronize state between the primary and standby units over the dedicated HA channel. They are trusted internal system communications that bypass security policy inspection entirely.
• B (Free ARP / Gratuitous ARP): Used during failover to refresh ARP caches on connected devices so traffic shifts to the new active unit. This is a Layer 2 HA mechanism handled automatically by the system, not inspected by security policies.
• C (Heartbeat detection): Keepalive messages exchanged between the HA peers to monitor each other's health. Like backup messages, these are internal control-plane traffic exempt from security policy processing.

Memory tip: Ask yourself - "Is this traffic generated by the HA system itself, or by users/services on the network?" Heartbeat, backup sync, and failover ARP are all internal HA plumbing (no policy needed). DHCP is real user-facing service traffic that the firewall must make a policy decision about, just like HTTP or DNS.

No community discussion yet for this question.