A retail bank runs an FTD active/standby pair with failover heartbeats and connection-state replication sharing one 1-Gbps link between the units. During large file transfers the standby sees delayed heartbeats and declares the primary unreachable even though it is still passing traffic. Which change to the failover link design keeps the pair's health checks accurate?
Select an answer to reveal the explanation.
Short Explanation
Your dedicated failover link keeps heartbeats separate from state replication, reducing the chance that state traffic delays health checks. It's like giving the smoke detector its own circuit instead of sharing the one the oven hogs.
Full Explanation
Failover on Threat Defense uses a control channel for heartbeats and unit-state messages, and a state channel to replicate connection records so sessions can survive a switch. When both share one physical link, state traffic can contend with heartbeat traffic, delaying heartbeats and causing a false detection. Giving failover traffic its own interface reduces that contention and the chance of congestion-triggered failover. Raising the hold time may mask brief congestion, but it also delays detection of genuine failures. Prioritizing failover traffic on the shared link may reduce queuing, but both roles still depend on one cable. Interface monitoring is a valid trigger, but it watches monitored interfaces rather than heartbeat timing. The failover and state interfaces must be configured with compatible addressing; each interface pair uses addresses in the same subnet, and the link needs enough bandwidth for the state traffic it carries. Practical check: run a sustained transfer, watch heartbeat timing and failover counters, and confirm no failover event appears in the system log.