topic ARP load sharing in General Topics

ARP load sharing

BBHLTD — Mon, 22 Oct 2012 15:13:41 GMT

We are planning to set up HA in Active Active mode. The boxes sit in separate locations with Layer 2 network between them. Currently our guest Network site on our second PA-2020 with our LAN on the first. Wer had to put the guest Network on second box as we had an issue where we was filling the arp table.

When you run Active Active how does arp load sharing work? Do you get twice the size arp table? If one firewall went down do and all traffic is hitting one firewall do you still get twice the arp table?

Hope this makes sense.

Re: ARP load sharing

mbutt — Mon, 22 Oct 2012 21:40:44 GMT

Hi,

Regardless of A/P or A/A high availability. Both the devices should never be configured to handle the load of more than one device. In case one device goes down the other will have to handle the load of both the devices. The table size will not increase with A/A for a single device. Hopefully this makes things more clear.

Please let us know if this helps.

Thank you

Numan

Re: ARP load sharing

mikand — Tue, 23 Oct 2012 08:27:51 GMT

A workaround could be to have the switch/routers before/after your cluster of PA's to do the loadsharing instead.

This way each PA is a standalone setup (you can use Panorama to get the same security policies out to the boxes) as described in: http://www.paloaltonetworks.com/literature/solution-briefs/tech-partners/arista.pdf (this can of course be aschieved with other components than Arista equipment - as long as your aggregated interfaces uses srcip as loadsharing hash on one end and dstip on the other, that is so the traffic will always takes the same path until that path fails and gets loadbalansed to another path)

The drawback is of course if you have fully utilized both paths and one path fails then you will get packetdrops because there is not enough of bandwidth available between outer and inner router/switches.

Another drawback is because each box is standalone then there is no session sync which gives that when box1 fails and all traffic goes through box2 then the clients who previously had their sessions through box1 will have dropped sessions and must reinitialize (which shouldnt be a problem but there are plenty applications out there who just cannot deal with that their tcp session suddently must reinitialize).