High availability failover: GARP doubts.

Nadeem69 — Fri, 14 Mar 2025 02:56:15 GMT

Hey guys!. First time poster here.

To begin with, I am beginner to PA and learning my way through. I have just reached the HA part, and have a few questions.

In an active/passive deployment, when the Active unit fails and the Passive unit starts taking over, it sends GARP and updates the downstream/ (upstream?) switches CAM tables with the new interface information.

My question is, if they both share a single vMac (Virtual Mac), and when the failover happens, does the passive firewall send the same vMac contained in the GARP to ALL of the interfaces its connected to, or is the vMac that is sent, different per interface? I read somewhere that the vMac is calculated per interface? Don't know how sure I am of that either.

Thanks for your time on this.

Re: High availability failover: GARP doubts.

JayGolf — Thu, 20 Mar 2025 18:10:25 GMT

Hi @Nadeem69 ,

If you log into the CLI of the palo and run a show interface all you should see different vMACs for each interface. Each firewall in the HA pair creates a virtual MAC address for each of its interfaces that has a floating IP address or ARP Load-Sharing IP address.

If vMacs were the same for each interface , there would be a bunch of mac address flapping and incorrectly forwarded/dropped frames.

Hope this help! There is also a techdocs on floating IP addresses and vMacs.

topic Re: High availability failover: GARP doubts. in Next-Generation Firewall Discussions

High availability failover: GARP doubts.

Re: High availability failover: GARP doubts.