4-Node Cluster (2x Active/Active) and "orphaned" zone

Johande — Fri, 13 Dec 2024 17:13:23 GMT

Hi,
I'm looking for some insight into the workings of the multi-node cluster functionality when there are more than two nodes.

Let's say I have two Active/Active pairs that are clustered with a HA4 Interface.

In this case I more specifically wonder how the behavior of session/state synchronization would work if the HA-Pairs had a Zone named differently than the other pair.

E.g.

HA Pair-1 Zones : Internet, LAN, Zone1

HA Pair-2 Zones : Internet, LAN, Zone2

I know what the documentation says, but what happens if this would be the case? Zone1 and Zone2 leads to completely different Networks. Internet & LAN is the same networks and HA4 would sync state/sessions for those, so they're covered.

It kinda hurts my brain just thinking about it, but does anyone have some insight? Maybe you've tried it?

Re: 4-Node Cluster (2x Active/Active) and "orphaned" zone

OtakarKlier — Tue, 10 Dec 2024 22:28:46 GMT

Hello,

Before going down the A/A rabbit hole, make sure you really want that config, eg requirement for asymmetric routing.

https://live.paloaltonetworks.com/t5/general-topics/active-passive-vs-active-active-recommendations/td-p/290714

However in either case, the configurations of the two firewalls in the HA will must be identical.

Regards,

topic 4-Node Cluster (2x Active/Active) and "orphaned" zone in Next-Generation Firewall Discussions

4-Node Cluster (2x Active/Active) and "orphaned" zone

Re: 4-Node Cluster (2x Active/Active) and "orphaned" zone