topic PanOS 10.1 Clustering in General Topics

PanOS 10.1 Clustering

Charlie80 — Tue, 13 Dec 2022 15:11:09 GMT

Hello,

I am used to configuring clusters on PanOs 8.x and 9.x.
I am now configuring a new infrastructure based on PanOs 10.1.8.

I have seen new options in "High Availability".
1) Under "General" tab what is "Clustering settings" for?
2) what is "Cluster Config" for?

Thanks

Re: PanOS 10.1 Clustering

Alejandro_Hernandez — Tue, 13 Dec 2022 15:16:36 GMT

Hi Charlie

This link will help

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-clustering-overview

Re: PanOS 10.1 Clustering

BPry — Tue, 13 Dec 2022 15:29:54 GMT

@Charlie80,

To expand on this a bit, what you're used to seeing is just a traditional HA setup. In that regard, you're likely used to seeing Active/Passive and Active/Active from a configuration standpoint. This provides the basis of redundancy to avoid a firewall failure from bringing down your entire environment.

With HA Clustering, that process is expanded by quite a bit. This sees the addition of HA4 and HA4-backup interfaces to actually control the clusters, because HA1-3 are already in use if you have an HA pair configured as cluster members. The clustered firewalls all share session state in the event of a failover, but the session owner is the one actually processing and logging the traffic.

The benefit here is that in a distributed environment, you could lose the primary HA pair and traffic would simply failover to another pair in the cluster. You get additional redundancy across your network that maintains session survivability instead of updating routes due to the loss of the pair.