Configuring 1+1 Backup by High Availability (HA)

Disconnect the power chord. No joke:wink:

Any plans/possibility to have this on the Balance 30 LTE?

I have a similar situation here and would like to ask the same question to peplink, is it required to have 2 switches attached to the ISP router? What will be the difference with and without the switches?


Hi Chintan_Ved,

I would use the Switches.

  • to be shure, that the ARP-table is correct
  • to be shure, that the Port config is correct
    (If ther is eg. a routing entry in the ISP-router like “send all data on LAN1”, then you will have a problem)
  • I certainly forgot some points

The Switches are not 100% necessary, but it easier with them. If you don’t want to use them, you have to understand the configuration and the routing mechanism of your ISP router


Hi Dennis,

            Thanks for your quick reply, some points like for example arp or vlan database would serve the purpose of those switches over there. Thanks for highlighting this to me. 

Chintan Ved

1 Like

Hi Team.

Can anyone please confirm if these are the scenarios in which the slave unit will become master? Am I missing one?

  1. In case of total failure
  2. LAN port disconnection
  3. All enabled wan ports disconnection


@hcardenas, yes you are right!

1 Like

Thank you!

TK, please correct me if I’m wrong:

The slave will become master if the master stops answering on the virtual ip.

The master will stop answering on the virtual ip if :

  1. In case of total failure
  2. In case of all WAN disconnected

The slave will become a master even if the master doesn’t become a slave if :

  1. there are LAN port disconnection (he doesn’t see the virtual ip anymore)
  2. the switch has issues etc

We’re encountering deployment issues because other brands can have virtual ip’s per vlan and selective master/slave scenarios per subnet/vlan. We’re hoping Peplink will develop it further. This is a critical feature for Entreprise SDWAN.



To be more specific, slave device will become master when it didn’t receive VRRP hello packet from master device


1 Like

I came across my first HA Master failure recently, and we were called to replace the unit.
Up until now, we only showcased HA availability switchover, by unplugging the Master power cable (as mentioned earlier in this thread)
I tried searching the fora and the knowledgebase about the required steps but couldn’t find all the steps necessary in one place.(OK i didn’t search thoroughly, i admit)

So this is what i did and successfully replaced the Master device and restored 1+1 Backup HA group - in case anyone else needs this information in the future
(If someone from peplink could point out any mistakes please let me know so I can correct this)

  1. The slave device has assumed Master role and all Speedfusion VPNs were up and running. The web interface of both the Virtual ip and the slave’s IP only showed status of the device, we couldn’t change any option

Solution: As pointed out earlier in this topic, this was because of the active Sync from Master checkbox. As soon as I unchecked this, we had full access to the GUI settings

  1. Downloaded the configuration from the Slave device

  2. Connected to the replacement unit, firmware downgraded it to match the FW version of the original devices (ain’t nobody got time for keeping critical devices up to date firmware-wise) and uploaded the configuration from the slave device (from System->Configuration->Upload Configuration from HA Pair)

  3. After uploading the configuration we had to change the LAN IP of the new device and the hostname.

  4. Check in Network->Misc Settings->High Availability that all settings matched between the two devices
    In the new device we specifically chose Master role and Resume Master Role Upon Recovery

  5. My biggest concern here was that we would need to reconfigure all Speedfusion Tunnels because they used the ID of the failed device (which i though was tied to the device’s hostname)

Solution: Peplink was smarter than this and the PepVPN Local ID may default to the device’s hostname but isn’t tied to it. So after uploading the configuration, the new device had the same Local ID as the old, but i could change the hostname without affecting VPN tunnels

  1. Connect the LAN and WAN interfaces to the cables that were initially plugged to the failed device

  2. As soon as the device turned on, it resumed Master Role within seconds. No issues were reported (or noticed) by the users of the speedfusion connections (boy, were they critical)

  3. Logged in to the slave’s IP and re-checked the sync config from master (with the serial number of the new device of course)

  4. Profit

Hope this info would help someone in the future
Again if someone sees any unnecessary or simply wrong steps, please let me know so I don’t mislead other people


What is the correct procedure for updating firmware on a master/slave pair with minimal downtime?


Please check the knowledge base below:


Do you have the pdf version on this great instruction?

We’re looking on “Peplink HA setup requirement and instruction guidebook” - to be documented. We need to submit this instruction in document form to FSI customer.

1 Like

we have WAN Ports on Master configured as DHCP.
Will Slave clone the MAC Addresses of the Masters WAN Ports to ensure it takes the same IP Adresses in case of Failover?
thanks a lot

1 Like

How many nubnets can add more if i deploy a Configuring 1+1 Backup by High Availability (HA)??? Thanks

@tai.nguyennetmark, can you elaborate more? Do you mean what is the maximum VLANs can be added after HA is ocnfigured?

1 Like

Yes, its the same 128Vlan, Right?

Maximum VLANs supported for the device have nothing related to the HA setup. “802.1q VLANs Supported” is depend on the product models.

1 Like

Do I have to keep a current Incontrol 2 subscription for both my master and slave unit if I am using HA, or can I keep the Master current and let the Slave units subscription lapse?
I use Incontrol 2 to create the Speedfusion tunnels between our client routers and our Datacenter.