topic Re: How to handle if control link/data link failure in HA in General Topics https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16840#M12271 <HTML><HEAD></HEAD><BODY><P>Another idea is running fiber for your HA1 and HA2 ports.&nbsp; Not sure what boxes you have, but if the distance is too great and you have fiber, this works nicely also.&nbsp; Just connect two fiber ports, configure PANOS to use those ports as HA1 and HA2, and you're all set.&nbsp; No worry about what happens if a switch goes down!</P></BODY></HTML> Wed, 02 Feb 2011 04:56:24 GMT spolo 2011-02-02T04:56:24Z How to handle if control link/data link failure in HA https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16837#M12268 <HTML><HEAD></HEAD><BODY><P>Hi All,</P><P></P><P>I would like to know if our environment using 2 x PAN and formed HA. The control link and data link connected to switches as our office over 3 floors in the same building. If the switch failure, how did the PAN response? Will they are not able to fail over?</P><P></P><P>Thanks!</P><P>J</P></BODY></HTML> Mon, 31 Jan 2011 08:28:05 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16837#M12268 johnnyw 2011-01-31T08:28:05Z Re: How to handle if control link/data link failure in HA https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16838#M12269 <HTML><HEAD></HEAD><BODY><P>Hi JohnnyW,</P><P></P><P>If both HA1 AND HA2 links fail, both devices will detect that the other device has failed and they will both go Active.&nbsp; This is typically not a desirable behavior because you may have issues with IP conflict, routing, etc.</P><P></P><P>A couple of ways to minimize this risk: </P><P></P><P>(1) Use cables and not switches... Chance of cable failure is much smaller.</P><P>(2) Connect HA1 to switches that have some redundancy capabilities.&nbsp; HA1 is responsible for the management side of things and also heartbeat connectivity.</P><P>(3) Maybe there's a way to leverage link or path monitoring in your HA environment.&nbsp; Link and path monitoring will essentially monitor links on your firewall or paths (IP addresses outside the firewall) and if these links fail, then the firewall will put himself in a non-active state.</P><P></P><P>Just some thoughts!</P></BODY></HTML> Mon, 31 Jan 2011 18:10:38 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16838#M12269 spolo 2011-01-31T18:10:38Z Re: How to handle if control link/data link failure in HA https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16839#M12270 <HTML><HEAD></HEAD><BODY><P>Hi Spolo,</P><P></P><P>Thanks for your information. BTW, anyone like our environment that will cross flat or building for HA purpose? What is the best practice on this scenario? Thanks!</P><P></P><P>Regards,</P><P>J</P></BODY></HTML> Tue, 01 Feb 2011 16:31:07 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16839#M12270 johnnyw 2011-02-01T16:31:07Z Re: How to handle if control link/data link failure in HA https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16840#M12271 <HTML><HEAD></HEAD><BODY><P>Another idea is running fiber for your HA1 and HA2 ports.&nbsp; Not sure what boxes you have, but if the distance is too great and you have fiber, this works nicely also.&nbsp; Just connect two fiber ports, configure PANOS to use those ports as HA1 and HA2, and you're all set.&nbsp; No worry about what happens if a switch goes down!</P></BODY></HTML> Wed, 02 Feb 2011 04:56:24 GMT https://live.paloaltonetworks.com/t5/general-topics/how-to-handle-if-control-link-data-link-failure-in-ha/m-p/16840#M12271 spolo 2011-02-02T04:56:24Z