Changing HA from Active/Active to Active/Passive

For.Support — Fri, 17 Nov 2023 21:03:45 GMT

I would like to know if anyone has changed HA from AA to AP and has configured floating IP in AA mode. How was the solution to bring it to the AP?

Thanks a lot.

Re: Changing HA from Active/Active to Active/Passive

TomYoung — Sun, 19 Nov 2023 10:44:19 GMT

Hi @For.Support ,

Active/Passive HA only needs 1 IP address per interface. When the active NGFW fails, the passive starts using the IP address. It also send a Gratuitous ARP for data plane interfaces. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLVICA4

It sends the GARP "to update L2 and ARP table of neighboring devices." In most instances, a virtual MAC is used for the IP addresses. So, ARP tables do not need to be updated. However, the switch will update its L2 table when it receives the Ethernet frame. In most instances, the same virtual MAC is used for non-data-plane IP addresses. So, the steps in the doc only apply to hypervisor assigned MAC addresses.

So, to migrate from A/A to A/P, configure the floating IP address on the interface. If you are not using the IP addresses currently on the interfaces (i.e., only using the floating IP address for routing or other functions), then you can replace them with the single IP address.

Thanks,

Tom

topic Re: Changing HA from Active/Active to Active/Passive in General Topics

Changing HA from Active/Active to Active/Passive

Re: Changing HA from Active/Active to Active/Passive