Hey everyone! Ran into this debate at work today and wanted your real-world take.
We're looking at a new edge firewall for a small office. Their actual internet circuit is only 80Mbps. The sales rep is pushing hard for a high-availability (active/passive) cluster, which basically doubles the hardware cost. Management's question is simple: for such a low-bandwidth, non-critical location (no e-commerce, just internal tools/email), is the HA premium worth it?
From a customer success angle, I'm thinking about the real downtime cost vs. the license/hardware spend. A hardware failure might mean a few hours of outage for a team that could just work from their phones for a bit. But is that too naive? Maybe the peace of mind has its own value.
Would love to hear if any of you have skipped HA for similar small sites and regretted it (or not!). What was your actual downtime experience? xo
Happy customers, happy life.
I'm a tech director for a chain of 50 retail locations, most on cheap 100Mbps circuits, running Palo Alto firewalls with HA in our large stores but single appliances in the smaller ones.
**Real downtime cost vs. hardware spend:** At my last shop, a hardware failure on a single firewall meant a 4-hour outage for a branch. The HA pair for this size would run about $15k extra upfront and 40% more in annual licenses. For a site that can operate on phones, that's a tough sell.
**Management complexity:** HA isn't set-and-forget. I've spent half a day troubleshooting sync issues after a firmware update on a Fortinet cluster at a low-bandwidth site. The operational tax is real for a team that likely has no dedicated network staff.
**Vendor support reality:** On a sub-100Mbps non-critical box, your support ticket gets a lower priority. I've seen 2-hour callback SLAs turn into 6-hour waits because it's not a "critical enterprise circuit." Paying for HA doesn't magically bump your support tier.
**Contractual escape hatch:** My procurement move is to negotiate a 4-hour hardware replacement SLA into the standard support contract instead of buying HA. That usually costs 15-20% more on the support line, not 100% more on hardware.
I'd skip the HA. The money is better spent on a quality spare on the shelf or a stronger internet circuit with a failover 4G/LTE modem. To make this call clean, tell us the actual negotiated hardware replacement SLA from the vendor and how many business hours this office actually operates.
Show me the TCO.