topic Re: HA on a PA-450 using Strata Cloud Manager in Next-Generation Firewall Discussions

HA on a PA-450 using Strata Cloud Manager

James.Woodhouse1 — Fri, 23 Aug 2024 14:36:35 GMT

I’m attempting to configure active/passive HA on a PA-450 using Strata Cloud Manager as per this guide: https://docs.paloaltonetworks.com/ngfw/administration/high-availability/set-up-activepassive-ha/configure-active-passive-ha

I’m aware a PA-450 doesn’t have dedicated HA ports, however when using Panorama I can set Eth1/7 & Eth1/8 to HA mode as shown in the image below and it works fine:

When using Strata Cloud Manager, HA mode is not an option on interface configuration.

Using the Strata HA workflow, I’m able to set HA-1 to use the management interface, but then unable to list data interfaces as candidate for HA-2,

I’ve ensured that data interfaces are configured and set to L3 mode on each firewall in the pair.

Does anyone have any experience with this please?

Re: HA on a PA-450 using Strata Cloud Manager

MikeFreyman-WWT — Fri, 23 Aug 2024 16:13:23 GMT

The 'Interface Type' needs to be Default to be used for HA configuration in SCM. This needs to be configured in SCM at the Configuration Scope of each HA firewall.

That is what worked for me.

Re: HA on a PA-450 using Strata Cloud Manager

James.Woodhouse1 — Fri, 23 Aug 2024 17:22:37 GMT

Thanks Mike, I'll try that next week.
Just to confirm is the Interface type 'default' only for the interfaces intended for HA-1 & HA-2, or ALL other data interfaces as well?

Re: HA on a PA-450 using Strata Cloud Manager

MikeFreyman-WWT — Fri, 23 Aug 2024 17:46:03 GMT

Just the interfaces you want to use for HA.

Re: HA on a PA-450 using Strata Cloud Manager

James.Woodhouse1 — Tue, 27 Aug 2024 15:00:48 GMT

Hi @MikeFreyman-WWT
Thanks for the help, I finally got this working today after a bit of a journey!
(I'm attempting to use folders/snippets and variables from Day1)

Journey:

Create 'base' snippet (interfaces, zones, router, but excluding HA) and apply to top level 'branch' configuration scope
- Override variables on the firewall configuration scope

Create 'HA' snippet for HA interfaces with the aim of applying on the firewall configuration scope
- unable to set interface type to 'default' in snippet
  - delete Snippet

Set interfaces to 'default' at the firewall configuration scope

Create variables in 'All firewalls' configuration scope (with the aim of using on the firewall configuration scope) for:
- $eth1-7-ip-ha
- $eth1-7-ip-subnet-mask-ha
- $eth1-8-ip-ha
- $eth1-8-ip-subnet-mask-ha

Override variable values at the firewall configuration scope

Create HA Group, PUSH
- Receive Error, assuming due using one variable value (IP address) and applying to both HA peers

Delete HA group

Verify: 'base' snippet (interfaces, zones, router) and apply to top level 'branch' configuration scope = yes )
Verify: variable values for data interfaces applied at 'site' configuration scope = yes )
Verify: HA interfaces [Eth1/7 & Eth1/8] applied a 'firewall' configuration scope = yes)

Create variables in 'All firewalls' configuration scope
- $eth1-7-ip-ha-branch1
- $eth1-8-ip-ha-branch1
- $eth1-7-ip-ha-branch2
- $eth1-8-ip-ha-branch2
- $eth1-7_8-ip-subnet-mask-ha-branch-all

Create HA, received error upon (again assuming) using one variable [$eth1-7_8-ip-subnet-mask-ha-branch-all] in multiple [x4] places [HA control & data interfaces]

Delete HA group

Delete variables in 'All firewalls' configuration scope
- $eth1-7_8-ip-subnet-mask-ha-branch-all

Create variables in 'All firewalls' configuration scope
- $eth1-7-ip-subnet-mask-ha-branch1
- $eth1-8-ip-subnet-mask-ha-branch1
- $eth1-7-ip-subnet-mask-ha-branch2
- $eth1-8-ip-subnet-mask-ha-branch2

Create HA, error received again

Convert Subnet masks to manual [255.255.255.252] e.g. not using variable), but retain variable for IPv4 address [ e.g. $eth1-7-ip-ha-branch1]

Push, Success !

Re: HA on a PA-450 using Strata Cloud Manager

S.Cantwell — Thu, 07 Nov 2024 13:14:59 GMT

I am writing a reply to this, because I REALLY tried to follow along with the steps, but could not understand.

I needed to open a TAC case to get this simple configuration done. (Argh, if only tech documentation could be written much clearer. :P)

So, in basic terms, create your folder structure as you would for NGFW FWs.

For me, I ignore putting anything in the highest (parent) folder of All Firewalls.

I created a folder (LIB Firewalls) in SCM, and put 2 FWs in that folder (FW-A and FW-B)

I created my variable and interfaces in the parent LIB Firewalls folder. (not shown here)

But real clarification is to go to the actual FW-DEVICE (FW-A and FW-B).

This is my "before" picture (I want to have eth1/3 and eth1/4 used for HA)

Notice that eth 3 and eth 4 show as Not Configured.

I clicked on ethernet1/3

When you add your interfaces (which will be only for HA in my example ), you are presented with the ADD Ethernet window,

(Viola!) this is where you see the mysterious Interface Type with a radio button of Default.

You do not need to do anything anything, just hit OK, and the interface is now created (in the device folder itself).

Do this for your 2nd interface...and......

(This is my "after". Notice that now eth 3 and eth 4 currently show Auto (for Link Status)

Now you can come back to Configuration Scope for the parent folder (LIB Firewalls) and finish your configuration for HA with variables or IPs or whatever you need.

Thanks to Rae A (at TAC), who was wonderful and helped me in about 3 minutes. 😛

Re: HA on a PA-450 using Strata Cloud Manager

K.Allen598516 — Wed, 04 Feb 2026 22:35:09 GMT

For anyone that gets to the end of this thread and still sees no interfaces in the HA1 or HA2 Port pop-up menus, there appears to be a UI bug (among so very many) in Strata Cloud Manager. Click into the IPv4/IPv6 Address field below the HA1 Backup (Optional) Port field and enter any IP address (e.g. 1.1.1.1). Then erase it by clicking the X icon at the end of the field. This appears to force the UI to reevaluate the options available to it and your available interfaces will now show up from the pop-up menus. I'm not proud of how long it took me to figure this out, but at least I have a working HA config now. Thanks PA. =|