Change HA setup A-A to A-P

krlinks — Wed, 15 Feb 2023 12:40:13 GMT

Good Day. I am looking for pointers wrt changing the HA setup from A-A to A-P mode.

The existing setup is for PA-5200s and they are in A-A mode with floating IP bind to active-primary (logically active-passive) and the HA setting is locally managed.

Both the FWs are connected to panorama and they have unique interface IPs and dedicated templates.

Will the below steps help to achieve the HA setup changed as A-P and managed from the panorama template?

Break the HA setup and isolate secondary FW.
remove the HA config on the secondary firewall and do a local commit.
update the interface IPs of secondary FW with existing floating IPs.
commit & push to secondary FW
Disconnect the primary FW LAN connections to ensure the secondary receives the traffic from switches as they by default forward traffic to the virtual IPs
remove the existing template for the primary firewall and add the firewall to the secondary firewall template
add HA configs from panorama and push to both devices.

Re: Change HA setup A-A to A-P

JayGolf — Wed, 22 Feb 2023 06:23:58 GMT

Hi @krlinks ,

Here is a related thread with a recommendation.

topic Change HA setup A-A to A-P in General Topics

Change HA setup A-A to A-P

Re: Change HA setup A-A to A-P