Cisco SD-WAN Firewall High Availability: Two Routers, One Firewall

Two Cisco SD-WAN routers at a branch, each running a stateful firewall. Firewall high availability keeps their sessions in sync over a dedicated interconnect, so a router can fail without taking its calls and transfers with it. We walk the redundancy groups, the interconnect and LAN/WAN traffic symmetry, then reload the active router mid-call: the transfer stalls for five seconds and carries on, and the call loses four and a half seconds of audio. Chapters 00:00 Two routers, one firewall 00:15 Why a stateful firewall breaks on two routers 00:47 Redundancy groups and preempt 01:10 Keeping traffic on the active router 01:32 The test: reload the active router 01:49 The large branch in SD-WAN Manager 02:51 The interconnect port channel 03:11 The firewall policy 03:44 Sessions synced to the standby 04:08 Reloading the active router 04:39 The home router returns: preempt 05:22 Best practice Learn more (Cisco documentation) Cisco Catalyst SD-WAN Firewall High Availability: https://www.cisco.com/c/en/us/td/docs... Cisco Catalyst SD-WAN Design Guide: https://www.cisco.com/c/en/us/td/docs... Previous: legacy data centre with OSPF:    • Cisco SD-WAN Legacy Data Centre: OSPF Redi...   Recorded in the lab in October 2026. Lab software: Cisco Catalyst SD-WAN Manager 26.1.2.1; WAN Edge routers on Cisco IOS XE 26.1.1.