topic HA traffic "HSCI" over Switch in General Topics

HA traffic "HSCI" over Switch

mmarie — Tue, 21 Jan 2025 21:41:46 GMT

Can i use cisco switch as layer 2 between two PA-3410 for HA ports "HSCI" . as i need to connect the HA ports between two building using the dark fiber.

Appreciate your support

Thanks

Re: HA traffic "HSCI" over Switch

OtakarKlier — Wed, 22 Jan 2025 21:39:31 GMT

Hello,

Dont think you will be able to:

HSCI—The HSCI port is a Layer 1 SFP+ interface that connects two PA-3200 Series firewalls in an HA configuration. Use this port for an HA2 connection, HA3 connection, or both.

The traffic carried on the HSCI ports is raw Layer 1 traffic, which is not routable or switchable. Therefore, you must connect the HSCI ports directly to each other (from the HSCI port on the first firewall to the HSCI port on the second firewall).

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/high-availability/ha-concepts/ha-links-and-backup-links/ha-ports-on-the-pa-7000-series-firewall

If running active/passive, you can use one of the other port types for HA traffic to get what you need.

Regards,

Re: HA traffic "HSCI" over Switch

mmarie — Fri, 24 Jan 2025 13:27:45 GMT

Thank you @OtakarKlier

Re: HA traffic "HSCI" over Switch

OtakarKlier — Fri, 24 Jan 2025 15:14:52 GMT

Hello,

Might also want to read up on 'Clustering' if that will work for you?

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/high-availability/configure-ha-clustering

Regards,