High Availability for IOS XE Secure Routers Configuration Guide

Overview and Purpose

High Availability (HA) for IOS XE based secure routers managed by Dashboard lets administrators pair two supported devices in an active/passive warm-spare deployment. The active device forwards traffic, while the passive device remains connected to Dashboard and can take over when supported failure conditions occur.

Use this guide to plan HA addressing, add a matching spare, configure LAN and optional WAN virtual IP behavior, and verify the expected active/passive state. This guide focuses on customer-facing configuration and operational expectations for the supported active/passive implementation.

Prerequisites and Limitations

Before configuring HA, confirm the device, firmware, topology, and addressing requirements for the target network.

Licensing Requirements

Licensing is handled separately from the HA feature specification. Confirm the required license, entitlement, or early-access program status for IOS XE based secure routers managed by Dashboard before enabling HA.

Hardware Requirements

Use two Dashboard-supported IOS XE based Generation-2 secure routers in the same Security & SD-WAN network.
The primary and spare devices must be the same model and product identifier. Dashboard validation is expected to enforce this when the spare is added.
Each LAN subnet used for HA must have enough available IPv4 addresses for the shared virtual IP and per-device HA addresses.
If WAN virtual IPs are used, each paired WAN interface that shares a virtual IP must be in the same broadcast domain and must have sufficient addressing available.

Firmware Requirements

The controlling feature source targets IOS XE 26.2.1 for this HA behavior. Use a Dashboard-supported firmware release for the selected platform, and check the release notes for final availability before deployment.

Limitations

This guide documents active/passive HA. Full active/active HA is not supported in this release.
Templates and IPv6 are not supported for HA in this release.
If WAN virtual IP is enabled in a multi-uplink deployment, all configured WAN uplinks in the HA pair should use virtual IP addressing. Mixing WAN VIP and non-WAN VIP behavior is not supported in this release.
A single WAN uplink failure does not trigger an HA chassis switchover. Switchover is expected when all configured WAN uplinks fail or when a LAN-side HA condition requires it.
Stateful NAT and firewall session synchronization between active and standby devices is not supported in this release. Existing sessions may need to re-establish after a switchover.
If both devices in the HA pair have a LAN-side failure, HA operation is not supported.

Configuration Steps

Configuration steps use Dashboard terminology from the current IOS XE based secure-router documentation where available. Exact labels should be confirmed against the final Dashboard build before publication.

Plan the HA Topology

Confirm that both devices are the same supported model and product identifier.
Identify the LAN interfaces, VLANs, or subnets that require a shared default gateway.
Confirm that downstream addressing does not use IP addresses reserved by Dashboard for HA.

HA Components	Description
LAN redundancy	LAN virtual IP behavior is provided through VRRP between the paired devices. A minimum size of /29 is required per LAN subnet.
WAN redundancy	WAN virtual IPs are necessary and require shared WAN broadcast domains.
Failover	A LAN-side failure or loss of all configured WAN uplinks can trigger switchover.
Session state	DHCP state is synchronized. Note: Stateful NAT/firewall session sync is not included in this release.

Add the Spare Device

Navigate to Security & SD-WAN > Appliance Status.
Select Configure warm spare.
Choose a spare device that matches the primary device model.
Review any Dashboard validation messages before continuing.

Configure LAN HA Addressing

Review each LAN subnet that will participate in HA.
Confirm that the LAN virtual IP will be used as the default gateway for clients on that subnet.
Ensure the subnet has available addresses for the active and passive device HA addresses.
Dashboard will automatically configure the last two available addresses as HA interface IPs and use the configured LAN IP as the virtual IP. Avoid manually assigning addresses that Dashboard reserves for the HA pair.

Configure WAN Addressing

Use unique WAN uplink IP addresses when a WAN virtual IP is not required.
Use WAN virtual IP addressing only when both devices' corresponding WAN interfaces are in the same broadcast domain.
When using WAN virtual IP addressing with multiple WAN uplinks, apply the same WAN VIP model consistently across all configured WAN uplinks.
Confirm that each device also retains a unique WAN IP address for Dashboard management.

Save and Monitor the HA Pair

Save the HA configuration.
Confirm that the intended primary device shows as active and the spare device shows as passive or standby.
Verify that both devices remain connected to Dashboard using their physical WAN IP addresses.
Use Appliance Status, WAN Status, Route Table, and available live tools to confirm network reachability after configuration.

Expected Failover Behavior

Only the active device forwards user traffic in active/passive HA.
AutoVPN is functional on the active device. The passive device does not form overlay tunnels until it becomes active.
LAN-side VRRP is always enabled for the HA pair.
A LAN interface failure can trigger switchover to the spare device.
A single WAN interface failure does not trigger switchover when another configured WAN uplink remains healthy.
Loss of all configured WAN uplinks can trigger switchover.
DHCP state is synchronized from the active device to the standby device.