Anybus Defender High Availability Mode – HMS Support Portal

This guide is relevant to configure 2 Anybus Defender in High Availability real-time failover mode.

APPLICABLE PRODUCTS

Anybus Defender 6000 and 8000 series with PRO licenses

PRE-REQUISITES

An ethernet cable must connect both devices directly to support sharing the state-table in real-time.

VERSIONS USED IN THIS ARTICLE

Anybus Defender 2.5.2-2025111723

SETUP

RESTRICTIONS

The 2 units will work in ACTIVE - STANDBY mode where one unit is MASTER and the other units will be a BACKUP. Configuration is synced from the MASTER node to the BACKUP node automatically, however when MASTER is down, changes done in BACKUP - even while ACTIVE - will not be propagated back to the MASTER unit when it returns online.

Anybus Defender HA Configuration

Step 1 – Create Synchronization link

Create Users (Both Master and Backup)

Navigate to System -> User manager
Create a new user
Set scope to Local
Username “HA_USER”
Use a unique password

Interface (Both Master and Backup)

1. Navigate to “Interfaces” and choose an Interface for the HA, in this guide "igb3"

2. Enable interface

3. Change Description to HA_SYNC

5. In IPv4mConfiguration Type select Static IPv4 and choose an IPv4 address to connect the two defenders, in this example "20.20.20.1/24"

Example:

Firewall WAN and LAN failover Virtual IPs (Both Master and Backup)

Navigate to Firewall -> “Virtual IPs”
Select Hot Standby
Interface WAN
Address type Single address and Address(es) to the WAN Subnet, in this example “10.10.10.122/24”
Assign a Virtual IP Password

Navigate to Firewall -> “Virtual IPs” (LAN failover)

Select Hot Standby
Interface LAN
Address type Single address and Address(es) to the LAN subnet, in this example “192.168.200.122/24"
Assign a Virtual IP Password

Firewall Rules, communication and failover monitoring (Both Master and Backup)

Navigate to Firewall -> “Rules”

Action should be Pass
Interface is WAN and LAN
Address Family applies to IPv4
Protocol should be Hot Standby
Specify source to be the “HA_SYNC net” and destination “HA_SYNC net”

Navigate to Firewall -> “Rules -> HA_SYNC”

Action should be Pass
Interface HA_SYNC
Protocol “Hot Standby Sync”
Source and Destination is “HA_SYNC net”

Navigate to Firewall -> “Rules”

Action should be Pass
Interface HA_SYNC
Protocol “TCP”
Source and Destination is “Any”

NOTE: To ensure that outgoing traffic from the Defender has the Virtual shared IP as source address, Outbound NAT must be configured. This will ensure that ongoing traffic will failover smoothly.

Navigate to Firewall -> “NAT" -> "Outbound"

Click "Hybrid Outbound NAT rule generation.
(Automatic Outbound NAT + rules below)"
Save
Add new rule under "Mappings"
In the new window:
Interface: WAN
Under "Translation"
Address: WAN VIP (10.10.10.122 in this case)
Save
Do another rule but on the LAN interface and LAN VIP
Click "Apply Changes" at the top

Here is how it should look like.

Navigate to Status -> “system” -> “High Avail. Manager”

(Both) Set Hot Standby sync to be the IP you set on the other Defenders HA_SYNC interface, in this example 20.20.20.2
(Both) Synchronize Interface: HA_SYNC
(Master only) Synchronize Config to IP should be set to the opposite of MASTER (to BACKUP Anybus Defender)
(Master Only) Remote System Username to user on Backup (Username+Password)
(Master Only )Select the options you want to sync

Navigate to Status -> “High Avail. Sync”

Under Status – High Avail. Sync you will find the Hot Standby Interfaces along with their status, on the Master Defender it should say Master on both and on the Backup Defender it should say Backup on both.

If you get an error that says that the Hot Standby Protocol doesn’t exit.

You will need to download the Defenders configuration file under System – Backup & Restore and press “Download configuration as XML”, open the file in notepad and search for “<protocol>Hot Standby</protocol>” and change it to “<protocol>carp</protocol>” on both the WAN and LAN interfaces, and then under Restore Backup upload the file and press Restore Configuration. Do this on both Defenders.