topic Re: PA-440's, and Redundancy in General Topics

PA-440's, and Redundancy

Cookiemonster46 — Tue, 07 Mar 2023 20:39:20 GMT

Can you setup/configure 2 PA-440's inter-connected with one being a failover for redundancy in case the other bricks? Or only Dual ISP redundancy using Static Routes Path Monitoring feature, for Traffic failover?

Is it even possible to setup 2 PA-440's configured identically with one a hot(plugged in) failover? Forgive my terminology.

Re: PA-440's, and Redundancy

Cookiemonster46 — Tue, 07 Mar 2023 21:54:01 GMT

I think I have found my own answer, I am posting it here. Could someone verify this will work on Two identical PA-440's?

Re: PA-440's, and Redundancy

TomYoung — Tue, 07 Mar 2023 23:35:12 GMT

Hi @Cookiemonster46 ,

Yes, the PA-440 supports HA. Active/passive is recommended. The best practice is to use 4 cables between the two: HA1, HA1-Backup, HA2, HA2-Backup. You can change regular Ethernet ports to HA ports.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGNCA0

Thanks,

Tom

PS Order the rack tray PAN-PA-400-RACKTRAY to make it easier to rack. You could also order the 2nd power supply PAN-PWR-50W-AC, but with HA it's not necessary.

Re: PA-440's, and Redundancy

Raido_Rattameister — Wed, 08 Mar 2023 14:17:43 GMT

Yes you can set up 2x PA-440 in HA.

If you configure management interface to be used as HA1 then you need to configure one of dataplane interfaces to be HA2 to syncronize sessions over. Without HA2 all sessions need to be re-initiated when firewalls fail over.

If you have more dataplane ports available you can have HA1 backup.

HA1 backup eliminates split brain situation.

If you happen to disconnect mgmt interface on one of firewalls and they don't see each other any more over HA1 link then both become active at the same time and this is bad 🙂
HA1 backup helps in this scenario.

HA2 backup gives backup link for session sync but this is most likely overkill in small setup.