topic Re: Best practices for HA PANs and switch stack in General Topics

Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 03:24:57 GMT

For this scenario, assume a simple setup. Two firewalls in HA and two switches in a stack. Also assume the firewalls are in active/passive. Consider the below setup, each firewall has one physical link to separate switch members of the stack.

In this configuration, if switch member 1 fails and firewall 1 is the active firewall, does it automatically failover to firewall 2 if there is no link/path monitoring configured? Or are we to assume that without link/path monitoring, switch 1 failing and firewall 1 would remain active firewall and traffic to the internet would fail?

I typically always use the below configuration. Each switch has a port aggregate (802.3ad) and 1 connection in that LAG connects to each member switch. This utilizes double the ports but I was under the assumption the first scenario would only work with link/path monitoring. I also typically do the design so I can withstand any firewall failing AND any switch failing at the same time.

Finally, in the bottom configuration, does anyone have recommendation as far as setting up distribution configs on the switch side? (eg. mac src / dest). Are those needed?

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 06:30:26 GMT

Hi Mack,

Firewall1 will not trigger any failover if switch1 dies. Please refer following document.

HA active peer does not fail over when ethernet cable is pulled

You have to configure link monitoring for scenario 1.

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 12:23:23 GMT

So just to confirm.. in scenario 1, if switch 1 dies and firewall 1 is active.. no traffic flows to the internet unless link monitoring is enabled, correct?

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 13:45:43 GMT

Hi Mack,

It will follow bellow sequence of event.

1. Switch 1 dies

2. Which means port connected with Firewall1 dies.

3. Firewall will ignore the event because its not configured for link monitoring.

4. No Incoming traffic on Trust interface.

7.However Untrust interface remains active, you can ping internet from Untrust.

8. But Firewall1 remains active and rest of the interface remains active.

I would suggest to configure link monitoring, its a intelligent deciwsion.

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 13:53:42 GMT

Thank you! And to 100% confirm, internal to external traffic will not flow because the secondary firewall remains in a passive state.. correct?

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 13:55:19 GMT

Hi Mack,

I confirm 100% Internal to External Traffic will not flow, and secondary remains in passive state.

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 13:57:15 GMT

Thank you!

Can you provide insight in regards to my question for scenario 2?

"Finally, in the bottom configuration, does anyone have recommendation as far as setting up distribution configs on the switch side? (eg. mac src / dest). Are those needed?"

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 13:57:38 GMT

Hi Mack,

ITs wise to configure interface monitoring, only in few circumstance people dont configure it.

Do you have any reason for not to configure it?

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 14:02:07 GMT

Hi Mac,

Lets say you have implemented scenario 2, then cabling is good on Switch. You dont need any cabling changes.

However, Ports connected with Firewall remains in Access VLAN of Trust interface.

Let me know if that answers your query.

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 14:31:46 GMT

And Inteface on the firewall should be aggregated interface in L3 Mode with an IP address.

Re: Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 14:38:19 GMT

Thanks.. though my question is in relation to distribution algorithms for the 802.3ad channel.

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 14:41:20 GMT

Hi Mac,

On the switch there is no Etherchannel, its an individual Ethernet Ports.

Aggregate interface exist on PANW Firewall. You can leave it to default as its outgoing traffic from firewall. It doesnt matter which switch recieves it.

Regards,

Hardik Shah

Re: Best practices for HA PANs and switch stack

SDorsey — Fri, 05 Sep 2014 14:43:33 GMT

So you're suggesting to have the aggregate on the firewall but have that aggregate connect to standard interfaces on the switch with no port-channeling configured? The switch doesn't have to be configured for an 802.3ad aggregation as well?

Re: Best practices for HA PANs and switch stack

hshah — Fri, 05 Sep 2014 14:50:20 GMT

That is right Mackwage, Firwewall in aggregate, and it goes to stand alone port of Switch. And it will work just fine.

Let me know if my answer is Helpful.

Re: Best practices for HA PANs and switch stack

pulukas — Sat, 06 Sep 2014 17:29:08 GMT

Check out the full sample design in the Design Guide example 4.6 on page 80 and following. I think this is the scenario for your setup.

Designing Networks with Palo Alto Networks Firewalls