topic sizing HA links in General Topics

sizing HA links

fvanlancker — Wed, 02 Jan 2013 18:08:42 GMT

Hi all,

I would like to know what the requirements are on HA1, HA2 and HA3 links in an active/active deployment. Is there a formula to calculate this ?

Re: sizing HA links

sdurga — Wed, 02 Jan 2013 20:45:36 GMT

Can you please elaborate what do u mean by requirements, Is it the band width, or the latency between the interfaces or something else ? Which software and hardware are you using ?

Tx,

Sandeep T

Re: sizing HA links

fvanlancker — Wed, 02 Jan 2013 20:49:48 GMT

Assuming that we want to create an active-active cluster with X Gbps troughput.
The first packet arriving will be the session owner and using ip-modulo to decide L2-4 processing.
What would be the bandwidth requirements on the HA1, HA2 and HA3 links.
There must be a way to calculate this, in order to properly size the links.

HW: 2 x 5020

PANOS: 5.0.1

Re: sizing HA links

sdurga — Wed, 02 Jan 2013 21:42:05 GMT

Hi,

I believe the amount of traffic traversing through the HA3 is hard to predict. Because it varies on a lot of factors like the type of traffic/sessions (short lived sessions will cause more traffic to go through on the HA3). The mode in which the HA active/active is setup that is whether Vwire-mode or L3-mode. And also whether you are implementing arp load sharing or floating ip's. All these factors directly or indirectly affect the amount of packets that flow through the HA3 interface. In general I have seen customers using aggregate interfaces as HA3 interfaces so that one can add or decrease the band width accordingly. I have see customers using HA3 interfaces with 4-8 gbps of bandwidth with all of the 10 gig interfaces of the firewall connected to upstream and downstream. Again it varies from case to case. I believe you can start of with 8 gbps and monitor the HA3 interface for a while for the throughput and eventually you can adjust the size of this if you want the port badly. Regarding HA2 and HA1 you can use the dedicated interface which are sufficient.

Tx,

Sandeep T