The Stateful High Availability Upgrade is offered as an optional licensed feature. Only the primary unit in the HA pair needs to be licensed. With Stateful High Availability, the primary unit actively communicates with the backup on a per connection and per VPN level. As the primary creates and updates connection cache entries or VPN tunnels, the backup unit is informed of the changes. The backup unit remains in a continuously synchronized state so that it can seamlessly assume the network responsibilities upon failure of the primary unit with no interruption to existing network connections.
When the Stateful High Availability Upgrade is licensed, Virtual MAC capability is also licensed. Virtual MAC allows the backup unit in an HA pair to use the MAC address of the primary unit when a failover occurs. Alternatively, you can manually set a virtual MAC address for both units to use. Virtual MAC addressing contributes to network continuity and efficiency during a failover in the same way as the use of virtual IP addresses. During a failover, the backup unit uses the same virtual IP address that was used by the primary unit. The Virtual MAC feature avoids the need to update the whole network to associate the virtual IP address with the actual physical MAC address of the backup unit.