topic Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ? in General Topics

Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

wsf7528 — Wed, 17 Jan 2024 05:36:34 GMT

Do I need to deploy a switch between PA firewall (AP) and a Juniper Router in order to have an aggregate ethernet interface (AE) connected? Please refer to the diagram attached.

The setup is below:

PA-1 (A)-------------PA-2 (P)

| |

| LACP |

Juniper router

Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

wsf7528 — Wed, 17 Jan 2024 07:21:14 GMT

Here is the diagram.

Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

OtakarKlier — Wed, 17 Jan 2024 22:23:07 GMT

Hello,

I cannot say for sure, but shouldnt have to. The Juniper will just see the connection to the passive PAN as down.

Regards,

Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

wsf7528 — Wed, 17 Jan 2024 23:08:37 GMT

Thanks for your reply Otakar, from PA AP, it can keep track of the ae0 link, in case the ae0 (1xchild interface only) is not response ping or down, the Active PA can trigger a failover to the passive one.

However, I might think about if the traffic will go through ae1 link since the link is up on Passive PA and it will blackhole the traffice.

Or you think the traffic won't go through the ae1 between MX and PA-passive FW?

Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

Raido_Rattameister — Thu, 18 Jan 2024 13:49:04 GMT

Device > High Availability > General

If it is Shutdown then Juniper sees AE1 as down.

If it is set to Auto then AE1 link is up but passive Palo is not responding to ARP requests so if Juniper don't have any ARP entries pointing to AE1 it should not send any traffic towards it.

Benefit with auto is that you can have LACP pre-negotiated on passive Palo and failover takes less time.

Re: Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

wsf7528 — Sat, 20 Jan 2024 01:02:46 GMT

Thanks chaps!