--- title: Stateful Firewall Cluster High Availability Theater «... description: Stateful firewall HA clusters typically use a single-brain model where only the primary node runs the control plane (including BGP), with sessions and... canonical: https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Stateful Firewall Cluster High Availability Theater « ipSpace.net blog | daily.dev og:description: Stateful firewall HA clusters typically use a single-brain model where only the primary node runs the control plane (including BGP), with sessions and... og:url: https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z og:image: https://api.daily.dev/og/posts/uBK83Pr7Z.png og:image:alt: Stateful Firewall Cluster High Availability Theater « ipSpace.net blog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Stateful Firewall Cluster High Availability Theater « ipSpace.net blog **[ipSpace.net Blog](https://daily.dev/sources/ipspace)** · 4 min read · 0 upvotes · 0 comments ## Summary Stateful firewall HA clusters typically use a single-brain model where only the primary node runs the control plane (including BGP), with sessions and forwarding state synchronized to the secondary. On failover, BGP restarts from scratch on the new primary, making Graceful Restart the only mechanism to avoid network-wide BGP reconvergence. This design only truly protects against hardware failures like power supply failures, not software crashes or bugs — which are far more common today. The author argues this is 'HA theater' and advocates instead for two independent firewalls running BGP individually, using routing protocols to detect and route around failures rather than relying on cluster magic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do stateful firewall HA clusters handle BGP during failover? In a single-brain firewall cluster, only the primary node runs the BGP daemon. On failover, the new primary restarts BGP from scratch. BGP Graceful Restart is used to prevent peers from withdrawing routes during this restart period — peers keep their forwarding state, assuming the cluster maintained Non-Stop Forwarding. This avoids triggering full BGP reconvergence across the network while the new primary re-establishes its control plane. _Engineers designing firewall HA with BGP track failure mode discussions like this on daily.dev._ ### What failure scenarios does a stateful firewall HA cluster actually protect against? A stateful firewall HA cluster with a single-brain model reliably protects only against hardware failures such as power supply failures. Software crashes, forwarding table corruption, session table corruption, and LAN failures are not reliably handled — software bugs can prevent the standby from taking over if the primary doesn't fully die, and forwarding corruption may go undetected. _Network architects weighing HA cluster designs against independent firewall topologies find the trade-off analysis on daily.dev._ ## Similar posts on daily.dev - [When a Cloud Region Fails: Rethinking High Availability in a Geopolitically Unstable World](https://daily.dev/posts/when-a-cloud-region-fails-rethinking-high-availability-in-a-geopolitically-unstable-world-1ndvhoqp0) · InfoQ · 0 upvotes · 0 comments - [Racks, sprawl and the myth of redundancy: Why your failover isn’t as safe as you think](https://daily.dev/posts/racks-sprawl-and-the-myth-of-redundancy-why-your-failover-isn-t-as-safe-as-you-think-qqxvdsjma) · CSO Online · 0 upvotes · 0 comments - [When Kubernetes Meets Real Data Center Networking: Building a Routable, Resilient On-Prem Cluster with BGP and ECMP](https://daily.dev/posts/when-kubernetes-meets-real-data-center-networking-building-a-routable-resilient-on-prem-cluster-wi-6epvdu3rc) · Container Journal · 0 upvotes · 0 comments - [A live Kubernetes cluster can still have an ownership gap](https://daily.dev/posts/a-live-kubernetes-cluster-can-still-have-an-ownership-gap-by8o4s5rz) · The New Stack · 1 upvotes · 0 comments - [When failover isn’t safe: Building high-availability PostgreSQL on Kubernetes](https://daily.dev/posts/when-failover-isn-t-safe-building-high-availability-postgresql-on-kubernetes-nljmhojvb) · Datadog · 4 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#firewall](https://daily.dev/tags/firewall), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Stateful Firewall Cluster High Availability Theater « ipSpace.net blog","url":"https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z"},"datePublished":"2026-08-11T08:52:43.634Z","dateModified":"2026-08-11T09:09:45.654Z","description":"Stateful firewall HA clusters typically use a single-brain model where only the primary node runs the control plane (including BGP), with sessions and...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"ipSpace.net Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ipSpace.net Blog","logo":"https://media.daily.dev/image/upload/s--xS7E82MT--/f_auto,q_auto/v1786438303/logos/ipspace?_a=BAMAMicg0","url":"https://daily.dev/sources/ipspace"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,firewall,bgp","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ipSpace.net Blog","item":"https://daily.dev/sources/ipspace"},{"@type":"ListItem","position":3,"name":"Stateful Firewall Cluster High Availability Theater « ipSpace.net blog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/stateful-firewall-cluster-high-availability-theater-ipspace-net-blog-ubk83pr7z#faq","mainEntity":[{"@type":"Question","name":"How do stateful firewall HA clusters handle BGP during failover?","acceptedAnswer":{"@type":"Answer","text":"In a single-brain firewall cluster, only the primary node runs the BGP daemon. On failover, the new primary restarts BGP from scratch. BGP Graceful Restart is used to prevent peers from withdrawing routes during this restart period — peers keep their forwarding state, assuming the cluster maintained Non-Stop Forwarding. This avoids triggering full BGP reconvergence across the network while the new primary re-establishes its control plane. Engineers designing firewall HA with BGP track failure mode discussions like this on daily.dev."}},{"@type":"Question","name":"What failure scenarios does a stateful firewall HA cluster actually protect against?","acceptedAnswer":{"@type":"Answer","text":"A stateful firewall HA cluster with a single-brain model reliably protects only against hardware failures such as power supply failures. Software crashes, forwarding table corruption, session table corruption, and LAN failures are not reliably handled — software bugs can prevent the standby from taking over if the primary doesn't fully die, and forwarding corruption may go undetected. Network architects weighing HA cluster designs against independent firewall topologies find the trade-off analysis on daily.dev."}}]} ```