Always-On Network Security with USG FLEX H Series and HA - Questions and Answers

High Availability (HA) is a technology that ensures continuous network operation by utilizing two identical devices in an Active/Passive configuration. In the event of a failure of the active device, the passive one automatically takes over, minimizing downtime.

Key Requirements for HA Setup

• Identical device models: For example, two USG FLEX 500H units.
• Same firmware version: For instance, uOS 1.31 or higher.
• Registration in the same Nebula organization: Both devices must be registered under the same organization in the Nebula Control Center.
• Dedicated port for Heartbeat connection:
  Typically, the last Ethernet port on the device is used for heartbeat signal exchange between the devices.

HA Configuration Features

• Heartbeat connection: Devices exchange signals every 2 seconds via UDP port 694.
  If the passive unit misses two consecutive heartbeats, it switches to active mode.
• Configuration synchronization: All configuration changes on the active device are automatically synchronized to the passive unit.
  Important: Do not make changes directly on the passive device.
• Virtual MAC address: During role switching, a virtual MAC address is used to prevent ARP cache issues on the network.

License Management

• Only one license is required:
  All licenses from the active device are automatically inherited by the passive one when roles switch.
• How do you contact the Support Team for a License Transfer? Please check here: How do you contact the Support Team?

Frequently Asked Questions

How can I access the passive (slave) device in HA mode?
To access the passive device, you need to use the Management IP address configured during the HA setup. The slave device is only reachable through the dedicated heartbeat port and only via the specified management IP.

Is HA supported in Nebula mode on USG FLEX H with uOS?
Yes, HA is supported on USG FLEX H with uOS, but not directly through the Nebula cloud interface. Both devices must be registered in the same Nebula organization. However, all HA configuration and management are performed locally through the device’s web interface. This is referred to as a hybrid mode — the device is visible in Nebula for licensing and monitoring, but advanced features like HA are handled locally.

Can I use different device models for HA?
No. Both devices must be the same model and series, running the same firmware version, and registered to the same Nebula organization.

How can I disable HA synchronization for troubleshooting?
To temporarily disable HA synchronization, navigate to System > Device HA > HA Configuration in the web interface and pause HA.

How can I check the HA configuration sync status?
To verify the sync status between active and passive units, use the following CLI command:

show state vrf main device-ha _debug sync-info

This provides current synchronization state information.

How do I force a full HA configuration sync?
To trigger a full sync between devices manually, use the command:

cmd device-ha force-sync full

How do I unpair HA devices and return them to standalone mode?

1. Factory reset one of the devices (preferably the passive unit).
2. Reboot the device or use the “Resync” button from the web GUI to update the status in MyZyxel.
3. The devices will return to standalone mode.