Athena NGFW (Next-Generation Firewall)

Athena NGFW (previously known as Network Secure) provides comprehensive protection for every network perimeter, ensuring the safety of your valuable assets, data, and users from emerging threats.
{{ $t('productDocDetail.guideClickSwitch') }}
{{ $t('productDocDetail.know') }}
{{ $t('productDocDetail.dontRemind') }}
8.0.95
Athena NGFW (Next-Generation Firewall) {{ breadTitle }} User Manual System High Availability Link Aggregation
{{sendMatomoQuery("Athena NGFW (Next-Generation Firewall)","Link Aggregation")}}

Link Aggregation

{{ $t('productDocDetail.updateTime') }}: 2025-12-25

If you use Network Secure devices in the active/active Layer 2 mode, and the upstream and downstream devices of the Network Secure devices are routers that adopt link aggregation, you need to enable Link Aggregation to avoid transmitting the request packet and the return packet using different paths. For example, if a request packet passes through Firewall A while the return packet passes through Firewall B, the return packet will be dropped due to inconsistent paths. Link aggregation ensures that the request packet and the return packet are forwarded by the same Network Secure device. When enabled, the backend program automatically generates a number of 0 or 1 that does not appear on the page for each Network Secure device. The Network Secure device calculates results for all packets passing through the LAN or WAN interface based on their source and destination IP addresses. Packets are sent to and then forwarded from the corresponding Network Secure devices according to their calculation results (for example, a packet with a calculation result of 0 will be sent to and then forwarded from the Network Secure device marked as No.0). The configurations are shown in the following figure.

A screenshot of a computer Description automatically generated

Enable: Check Enable to enable link aggregation. Conditions for enabling link aggregation: HA policy is enabled; the active/active Layer 2 is used; interfaces for data synchronization are set; and at least two Layer 2 interfaces are available.

LAN Interfaces: Specify the downstream LAN interfaces for the local and peer devices.

WAN Interfaces: Specify the upstream WAN interfaces for the local and peer devices.

The workflow is as follows:

  1. When a PC accesses the server, the packet goes through Network Secure 1. Network Secure 1 determines, based on the hash algorithm, whether the security check should be performed. After the check is completed, Network Secure 1 forwards the packet to the server.
  1. The packet returned by the server arrives at Network Secure 0.
  2. Network Secure 0 determines, based on the hash algorithm, whether Network Secure 1 should perform the security check (calculation results for packets with the same IP address are the same). Network Secure 0 sends the packet to Network Secure 1 through the HA aggregation link.
  3. After receiving and checking the packet, Network Secure 1 sends the packet back to Network Secure 0 through the HA aggregation link.
  4. Network Secure 0 sends the returned packet to the PC.

A diagram of a network Description automatically generated

1. The monitoring interfaces of the active and standby devices must be the same.

2. If the priorities of the virtual groups are the same, no preemption will occur regardless of whether preemption is enabled.

3. Settings are synchronized in the following two ways: bulk synchronization and incremental synchronization. When the active controller sends a request to the passive controller for synchronizing settings from the peer device to the local device, bulk synchronization is triggered. After the bulk synchronization is completed, the device checks settings for changes every 10 seconds. If changes are detected, an incremental synchronization is triggered for synchronizing the modified settings of the active controller to the passive controller. A passive controller does not have permission to modify settings. To manually modify the standby device's settings, change the device's synchronization role. Otherwise, changes cannot be submitted.

4. If the database version of Device A is valid while that of Device B is expired, synchronizing Device A's upgraded database to Device B will fail. However, this does not affect the synchronization of other settings.

5. The two HA devices must be the same model. Devices of different models have a different number of interfaces. This can cause the two HA devices to work improperly because interface settings are also synchronized during the synchronization of settings between the two devices.