A colleague is mapping out Threat Defense clustering for a refresh project and asks how the roles divide the work. Which statement correctly describes the control unit, the data units, and the cluster control link in a healthy cluster?
Select an answer to reveal the explanation.
Short Explanation
Clustering gives you scale, but one control unit still owns management duties for the whole group. The cluster control link carries replicated state and heartbeats on its own path, away from production flows. Every cluster member, including the control unit, forwards traffic, and that's where your extra throughput comes from.
Full Explanation
In a Threat Defense cluster the control unit coordinates the group: it owns cluster-wide management and configuration, while every cluster member, including the control unit, forwards production flows, which is exactly why aggregate throughput can grow as appliances are added. The cluster control link carries heartbeat traffic plus replicated state such as connection and NAT records. A design that re-elects a control unit per connection misunderstands the role, because the control unit is a cluster-wide position rather than a per-flow decision, so management duties would constantly move. Forwarding only on the control unit describes an active/standby failover pair and quietly throws away the scale benefit that motivates clustering in the first place. Limiting the cluster control link to heartbeats assumes state replication can share the production path, which puts connection continuity at the mercy of traffic bursts. As a practical check, confirm the control unit role is stable and each data unit shows healthy replication counters.