topic Re: Changing palo alto from a/a to a/p in General Topics

Changing palo alto from a/a to a/p

hpitta — Tue, 04 Apr 2023 09:12:58 GMT

Hello, I need to change 2 palo alto from active/active to active/passive. Is there any guide or something that I can follow or understand what's need to be change.

I already have changed but lost connection on my globalprotect, I can connect but looks like I don't have any connection internaly.

Re: Changing palo alto from a/a to a/p

TomYoung — Tue, 04 Apr 2023 12:09:09 GMT

Hi @hpitta ,

Did you configure the active/active HA or did someone else? You need to remove any A/A use case configuration (floating IP addresses, ARP load sharing, etc.). https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/set-up-activeactive-ha/determine-your-activeactive-use-case

The cool thing about A/P HA is that the configuration is the same as a single NGFW. All that is needed is a single IP address per interface.

When you make a change of this scope, you need to be ready to clear the ARP tables of your connected L3 devices just like you were replacing a firewall. If your IP addresses have changed, you need to change your routing configuration on connected devices.

Thanks,

Tom

Re: Changing palo alto from a/a to a/p

hpitta — Tue, 04 Apr 2023 13:20:14 GMT

Hello, thank you for your fast reply!

It was not me that have configured HA, I think this could be my main problem, but the work have to be done.

When I have my firewalls in A/A I can without problems connect to my globalprotect vpn and access all my internal machines and go to the internet. But when I change to A/P and make commit I receive an error with

"Validation Error:

(network -> tunnel -> global-protect-gateway -> GP_GW-N -> local-address -> floating-ip -> ipv4 '' is not a valid reference"

Re: Changing palo alto from a/a to a/p

TomYoung — Tue, 04 Apr 2023 13:54:27 GMT

Hi @hpitta ,

Thanks for the info. Notice the "floating-ip" in the error message. I mentioned floating IP addresses in my 1st post. Open the gateway configuration and change the selection to the IP address on the interface. That will fix the error above. You probably will get many more errors.

This is a complicated process, and I cannot walk you through every change. Please open a TAC case if you need more in-depth help. If you want to do it on your own, you will need to familiarize yourself with the (1) use case configurations, (2) routing changes, and (3) ARP behavior, and be ready to make changes on the NGFW and connected network devices.

Thanks,

Tom