What helps avoid split brain in active / passive high availability (HA) pair deployment?

Question

Options

• AEnable preemption on both firewalls in the HA pair.
• BUse a standard traffic interface as the HA3 link.
• CUse the management interface as the HA1 backup link
• DUse a standard traffic interface as the HA2 backup

• A
  7% (2)
• B
  18% (5)
• C
  71% (20)
• D
  4% (1)

Explanation

Using the management interface as the HA1 backup link (option C) prevents split brain because HA1 is the heartbeat and control link - if the primary HA1 link goes down with no backup, each firewall concludes the other is dead and both claim the active role simultaneously. Adding the management interface as a secondary HA1 path ensures the heartbeat survives a single-link failure, so only one unit ever holds the active role.

Why the distractors are wrong:

• A (preemption on both): Preemption controls which unit reclaims the active role after recovery - it has nothing to do with preventing dual-active split brain and can actually cause role-flapping if misconfigured.
• B (standard interface as HA3): HA3 is a packet-forwarding link used in active/active deployments for asymmetric traffic handling - irrelevant to split brain in an active/passive pair.
• D (standard interface as HA2 backup): HA2 carries session/state synchronization (routing tables, sessions). Losing HA2 causes state desync, not split brain - split brain is a heartbeat (HA1) problem.

Memory tip: Think "HA1 = Heartbeat 1st priority - back it up or both units go active." The management interface is ideal as a backup because it travels a physically separate path from data interfaces, so one link failure can't silently kill both HA1 paths at once.

No community discussion yet for this question.