Configuring NetScreen Firewalls

A chapter on HA and NSRP would not be complete without a more in-depth dissection of what happens when a failover occurs. Things that can cause a failover are:
Software crashes (resulting in lost heartbeats)
Hardware or power failure (resulting in lost heartbeats)
Link failure on monitored interfaces or zones
Unavailability of one or more tracked IP addresses
Manually requested failover
Once the primary backup VSD has determined that it must become the master VSD, a few things happen. Firstly, the VSD promotes itself to master to prevent any other VSD from doing the same thing. Second, if the VSD has any links down, an attempt is made to bring them up. If a monitored link cannot be brought up, the VSD relinquishes its role as master and puts itself in the inoperable state. (See "Avoiding the No-brain Problem" in this chapter.)
Assuming the VSD is the newly promoted master VSD with all relevant links up, it proceeds to send out gratuitous ARP requests. This is a very important aspect of the failover. These ARP requests tell the neighboring network nodes that the IP addresses configured on the VSIs are now reachable via a different path than before. This will cause switches to update their forwarding tables, and routers to update their ARP tables. By default, four ARP packets are sent out on each interface, but this can be adjusted if needed (see the example below).
As soon as the neighboring nodes have adjusted to this change,...