3.3 Ensure 'Passive Link State' and 'Preemptive' are configured appropriately - Election Setings

Information

Set the Passive Link State to auto, and uncheck the Preemptive option to disable it.

Rationale:

Simultaneously enabling the 'Preemptive' option and setting the 'Passive Link State' option to 'Shutdown' could cause a 'preemptive loop' if Link and Path Monitoring are both configured. This will negatively impact the availability of the firewall and network services, should a monitored failure occur.

Impact:

Incorrectly configuring this setting will adversely affect availability, rather than positively affect it.

Solution

To set Active/Passive Settings correctly:
Navigate to Device > High Availability > General > Active/Passive Settings.
Set Passive Link State to auto.
To set Election Settings correctly:
Navigate to Device > High Availability > Election Settings.
Set Preemptive to be disabled.

Default Value:

Not Configured

See Also

https://workbench.cisecurity.org/benchmarks/8826