Use of HA2 and HA3 port Active-Active-Active

Alpalo — Tue, 24 Oct 2023 07:42:06 GMT

Hello,
We have changed PA-5220(10.1.6-h6) by the PA-3420(10.2.5) , and we have detected that much more traffic is being sent by the HA2 and HA3 ports.
Being unbalanced, it saturates a port of HA2 and may cause an error in the synchronization of sessions.

Does anyone know how to check this or know the reason why this is happening?

Thanks

Re: Use of HA2 and HA3 port Active-Active-Active

TomYoung — Tue, 24 Oct 2023 14:23:18 GMT

Hi @Alpalo ,

The HA ports have different functions.

HA1 = Control Link

HA2 = Data Link

HA3 = Packet-Forwarding Link

The detailed explanation is here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-concepts/ha-links-and-backup-links.

So, there is no way to balance the traffic over multiple HA links. The solution is to upgrade the HA2 port (and the HA2-Backup if configured). If it is currently 1G, change to a 10G port. If it is 10G, change to a 25G port. The best 10G for direct connect would be PAN-SFP-PLUS-CU-5M or equivalent. I don't see a direct connect 25G cable. Maybe the PAN-QSFP28-DAC-5M would work, but you would need to confirm. It is a shame PANW does not make these cables in smaller lengths (that I have found).

Thanks,

Tom

topic Use of HA2 and HA3 port Active-Active-Active in General Topics

Use of HA2 and HA3 port Active-Active-Active

Re: Use of HA2 and HA3 port Active-Active-Active