topic Re: How HA active/passive 2000 series works in General Topics

How HA active/passive 2000 series works

Thiago — Fri, 23 Mar 2012 19:40:52 GMT

Hi Guys ,

I have a dubt about HA Active/passive

How it`s works ? i need to have a float IP ?

OR my 2 appliances need to have the same configuration ?

I see some docs , but i don`t understand how HA works.

So if somebody can help me I`m using 4.1.3 PAN-OS.

Best Regards.

Thiago Lima.

Re: How HA active/passive 2000 series works

jseals — Fri, 23 Mar 2012 19:54:56 GMT

Hello,

Active Passive won't be using a floating IP. The devices share their configs and that includes interface IP addresses. The passive member always takes down all of it's interfaces as to not cause issues with duplicate IPs on the network.

Typically, just configure the active device as you'd like, configure the HA settings for both members and enable config sync. Once you commit they should be paired just fine.

If you'd like more information on how to configure the HA portion, let us know.

Thanks,

Jason Seals

Re: How HA active/passive 2000 series works

Thiago — Fri, 23 Mar 2012 20:15:44 GMT

Hello Jason ,

So about Mac adresses , the devices shares yours mac address or not ?

Best Regards.

Thiago Lima.

Re: How HA active/passive 2000 series works

jseals — Fri, 23 Mar 2012 21:35:50 GMT

Hi,

In Active / Passive HA, the members use the same virtual MACs on the dataplane interfaces which are derived from the HA group ID setting in the HA configuration.

Note that the MAC addresses of the HA1 interfaces, which are on the control plane and synchronize the configuration of the devices, are unique. The MAC addresses of the HA2 interfaces, which are on the data plane and synchronize the active sessions, mirror each other.

Thanks,

Jason Seals

Re: How HA active/passive 2000 series works

Thiago — Sat, 24 Mar 2012 17:23:37 GMT

So ,

When i`m configuring HA Active/Passive , i need to set the same group ID to my 2 devices right ?

Best Regards.

Thiago Lima.

Re: How HA active/passive 2000 series works

jseals — Sat, 24 Mar 2012 18:24:36 GMT

Yes,

The same group ID for both devices. This is important.

Also, if you ever have more than one HA pair on the same network be sure that each pair has their own group ID.

If two HA pairs are on the network, and all 4 members have the same group ID, this will for sure cause issues due to the mac address assignment.

Thanks,

Jason Seals

Re: How HA active/passive 2000 series works

mikand — Sat, 24 Mar 2012 18:57:37 GMT

Speaking of which... is it possible to have active / passive / passive / passive setup (regarding your example of 4 boxes with the same groupid) ?

I cant figure out of any good example for one would like to have such setup but still :smileysilly:

Re: How HA active/passive 2000 series works

jseals — Sat, 24 Mar 2012 19:34:32 GMT

Hi Mikand,

I can't think of a reason you'd want to do that either, and I don't believe this would be possible.

When configuring the HA links in L3, there is only an option for 1 peer IP address. Therefore, the standard 1 active machine and 1 passive machine seems to be it.

Thanks,

Jason Seals

Re: How HA active/passive 2000 series works

Thiago — Sun, 25 Mar 2012 03:11:00 GMT

Mikand ,

I think it`s impossible to configure HA with 4 devices.

First of all , you can configure just 1 peer device.

And second on 2000 PAN serie , you can configure just 2 HA port per each device.

First port manage plane to syncronize confs , etc.

Second port to do stateful.

Best Regards.

Thiago Lima.

Re: How HA active/passive 2000 series works

Thiago — Tue, 27 Mar 2012 01:05:16 GMT

Hi Guys ,

I`m configuring HA , but when i shutdown my first device , i did one test using ping , and i lost 3 packest with 64 TTL

It`s normally , or it`s possible to configure something to make this more fast ?

Best Regards.

Thiago lima.

Re: How HA active/passive 2000 series works

jseals — Tue, 27 Mar 2012 01:17:56 GMT

Hello,

That's about normal. Also, I've seen that sometimes the pings actually do reply, but due to the failover it takes longer than normal to respond, so the ping application considers it a timeout.

You could verify this with pcaps taken on the firewalls. This may be your case, or it may just be taking that long to transfer the sessions over.

Regardless, what you're seeing is normal.

Thanks,

Jason Seals

Re: How HA active/passive 2000 series works

christopher_d_groshong — Tue, 08 May 2012 04:11:23 GMT

Jason,

Thanks for comments, if those two paragraphs were in the admin guide it would have saved me about 2 hours today

Re: How HA active/passive 2000 series works

ncampagna — Tue, 08 May 2012 19:43:13 GMT

Christopher,

Which piece of information did Jason provide that you would like to see in the admin guide? I'd like to see about adding that into the guide.

Thanks,

Nick Campagna

Product Management