N+1 Clustering of firewall

Is it possible to configure 2 firewalls in active/active mode and a third firewall in passive mode so that whenever one of the active firewall is unavailable the passive firewall will become active.

Have anybody configured this with NSF?

Hi, as i know, firewall clustering are made using only two firewalls. Even on Sangfor NGAF, i did't see anything so far about threee nodes configuration on technical documentation.

Hi

Yes it's posibble.
Connect the HA ports to set up a physical connection between the firewalls.
For firewalls with dedicated HA ports, use an Ethernet cable to connect the dedicated HA1 ports and the HA2 ports on peers. Use a crossover cable if the peers are directly connected to each other.
For firewalls without dedicated HA ports, select two data interfaces for the HA2 link and the backup HA1 link. Then, use an Ethernet cable to connect these in-band HA interfaces across both firewalls.
Use the management port for the HA1 link and ensure that the management ports can connect to each other across your network.

Hello,

For best practises is just two devices, but your question is absolutely Absurd ...
Maybe in the future we can deploy like that,

In most firewall configurations, you can set up two firewalls in an active/active mode, which means both are handling traffic. However, adding a third firewall in a passive mode that becomes active when one of the others fails is not a standard configuration and might not be supported by all firewall vendors.

For Sangfor specifically, I couldn’t find any direct information about this specific configuration. Sangfor’s Network Secure Firewall (NSF) does support High Availability (HA) configurations1, but it’s typically in an active/passive setup2.

In an active/passive HA setup, one firewall is active and handles all traffic, while the other is passive or standby. If the active firewall fails, the passive firewall becomes active and starts handling traffic. This setup ensures there’s no interruption in traffic flow if one firewall fails2.

However, it’s important to note that configurations can vary based on the specific requirements and network architecture. If you’re considering this type of setup, I would recommend reaching out to Sangfor’s technical support or a network engineer who is familiar with your network for more specific guidance.

As for NSF, Sangfor NSF does support various configurations, including SSL VPN3. But again, for your specific scenario, it would be best to consult with a network professional or Sangfor’s support.

Please note that while I strive to provide accurate and timely information, network configurations can be complex and should be handled by a qualified professional to ensure security and functionality. Good luck!