topic Re: HA failover time in General Topics

HA failover time

proscar — Fri, 07 Sep 2012 22:39:02 GMT

Hello,

How many time does failover take in seconds (when it happen)?, I have an Active/Passive deployment and I hope to use 5050 platform

Re: HA failover time

sraghunandan — Sat, 08 Sep 2012 01:58:18 GMT

Hello,

Failover can depend on a lot of factors please refer these docs:-

https://live.paloaltonetworks.com/docs/DOC-2034

https://live.paloaltonetworks.com/docs/DOC-1094

Thank you.

Subijith Raghunandan.

Re: HA failover time

sraghunandan — Sat, 08 Sep 2012 02:01:32 GMT

Also please refer this doc which talks about configuration :-

https://live.paloaltonetworks.com/docs/DOC-2926

Re: HA failover time

acamacho — Tue, 11 Sep 2012 22:12:34 GMT

The Hello Interval is the time interval between heartbeat packets that are sent to verify that the opposing firewall is operational. The minimum value for hello interval is 1000 milliseconds (1 second) on the PA-4000 series, and 8000 milliseconds on the PA-2000 series. Setting the value to the minimum is recommended to achieve optimal failover times. When there is a loss of 3 hello messages the adjacent firewall is declared to be down and the passive device will become active

See https://live.paloaltonetworks.com/docs/DOC-1094 which was recommended in an earlier post.

Re: HA failover time

wimjuste — Thu, 28 Feb 2013 15:58:55 GMT

Don't they mean the HEARTBEAT interval parameter? Because the minimum value for HELLO on PA-5020 is 8000ms, I can't imaging having to wait for 3x 8000ms before a failover takes place?

If not, what is the purpose of the HEARTBEAT interval parameter?

Also, is the 3 times retry value configurable?

Re: HA failover time

zarina — Fri, 01 Mar 2013 17:53:49 GMT

Hello interval is used to determine if the ha_agent process on the peer device is up and running whereas the heartbeat interval will determine if the peer is up and running. So increasing the value of hello interval should not effect the failover times unless ha_agent hangs.

Re: HA failover time

Gregoux — Wed, 05 Nov 2014 17:48:05 GMT

Heatbeat Interval(1s mini on PA 5000 4000 3000 and 2s minimum on the other) is different as hello interval (8s mini) and a failover base on hello intervall is rare

and you need to wait 3x heartbeat intervalle to triggred a failover.

plus you need to considered the promote hold time with a minimum of 500ms.

brief as minimum if you triggered a failover you need to wait 3,5s before retrived something working

any comment?