topic Re: HA Clustering Info in General Topics

HA Clustering Info

VFaticati — Thu, 09 Jun 2022 13:19:14 GMT

Hi all,

i have a question for all:

i have two datacenter in two different city. The datacenters comunication in Layer 2 witn VRRP.

In primary DataCenter (active) i have two FW in Active/Passive (Peer HA), i would configurate a new FW in secondary data center (in passive mode), same model FW, it's possbile? how to configuration this scenario?

Thank you.

V.A

Re: HA Clustering Info

OtakarKlier — Thu, 09 Jun 2022 14:45:02 GMT

Hello,

Possible yes since your HA interfaces can be any of the interfaces on the PAN. My biggest question would be why? Have the secondary data center PAN standalone and active. You can control routing via OSPF and route metrics.

Just my thoughts, I'm sure you have specific requirements.

Regards,

Re: HA Clustering Info

VFaticati — Thu, 09 Jun 2022 14:48:20 GMT

the datacenter passive, it's work only for disaster recovery.

Re: HA Clustering Info

OtakarKlier — Thu, 09 Jun 2022 14:51:58 GMT

Hello,

I've done similar configs, and my DR data center was active. just disable the inbound NAT's. However you should be able to set it up the way you described.

Just a thought.

Re: HA Clustering Info

VFaticati — Thu, 09 Jun 2022 15:02:34 GMT

OK so every FW in the cluster in Active/Passive I have to configure HA1, HA1-Backup, HA2, HA2-Backup and H4, HA4-Backup and all interconnected? Are there any guides?

Re: HA Clustering Info

OtakarKlier — Thu, 09 Jun 2022 17:43:38 GMT

Hello,

Hopefully the answer lies in the following:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

Regards,

Re: HA Clustering Info

aleksandar.astardzhiev — Fri, 10 Jun 2022 12:17:03 GMT

Hi @VFaticati ,

Can you clarify if I get your question correctly - you want all three firewalls to be in HA cluster and share session information?

If I understand that correctly, it is possible, this feature was introduced in version 10.0, so you need to use 10.1 and above (10.0 is no longer supported).

The following gives overview of the feature - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-clustering-overview As you can see from the link only some devices are supporting such setup, so you may check that as well.

There is also the steps how to configure "HA clustering" - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/configure-ha-clustering

Re: HA Clustering Info

fyeung — Mon, 27 Feb 2023 23:25:11 GMT

Hi @aleksandar.astardzhiev ,

For the case you mentioned, is it require a load balancer for session distribution? for my case all of the gateway are required to terminate on PA firewall, and same as @VFaticati , one DC with A/P HA, and the other one is standalone.