topic Re: HA setup doc in General Topics

HA setup doc

usvi — Tue, 12 Mar 2013 23:41:01 GMT

I am looking for the setup documentation to setup HA when the devices aren't directly connected . We have a requirement to setup fail-over to recovery site reachable via IP . I have seen the doc to setup HA with the devices next to each other .

Thanks

Re: HA setup doc

mharding — Tue, 12 Mar 2013 23:53:38 GMT

There's really not that much difference. I have it setup right now with our passive device across town using a Metro Ethernet link. I have HA1 and HA2 on separate VLANs. You can setup HA2 as a L3 interface, but I haven't had a problem using it in L2 for nearly five years.

You just have to watch your timers and STP setup. The attached document should help there.

Re: HA setup doc

usvi — Wed, 13 Mar 2013 00:16:28 GMT

Hi,

The boxes are 2020s and there are no vlans .

Re: HA setup doc

mharding — Wed, 13 Mar 2013 00:37:01 GMT

This is the document you want. This will walk you through setting up both HA1 and HA2 as L3 interfaces.

Re: HA setup doc

usvi — Wed, 13 Mar 2013 00:55:24 GMT

I have that doc and used it for HA when the boxes are next to each other . What settings do i need to change to setup it when there are separate environments. As i said the boxes are 2020 . I usually setup ports 11 and 12 . 11 being the control link and 12 being the data link

Re: HA setup doc

mharding — Wed, 13 Mar 2013 01:13:12 GMT

Do you not have a link between these two locations?

Re: HA setup doc

usvi — Wed, 13 Mar 2013 01:19:04 GMT

yes we do . There is fiber based MPLS network .

Re: HA setup doc

usvi — Wed, 13 Mar 2013 01:22:06 GMT

Another thing is we want to setup an ipsec vpn b/w the two sites .

Re: HA setup doc

usvi — Wed, 13 Mar 2013 01:44:15 GMT

I am looking at the doc again and it says the control link if on separate broadcast domains you need to specify the gateway only . The two sites are on separate domains as each has a router . So the IP of the gateway is the public address of each unit . So on both the control and data link all we need to setup are the gateway ips and on the data link select IP for transport . Am I correct ?

Thanks

Re: HA setup doc

cstancill — Wed, 13 Mar 2013 02:27:33 GMT

Roland,

If you have connectivity between the two sites then yes, you just need to add the gateway that the HA port will use to reach the other firewall.

Re: HA setup doc

cstancill — Wed, 20 Mar 2013 06:00:34 GMT

Roland,

Did you need additional information?

Re: HA setup doc

mharding — Wed, 20 Mar 2013 15:00:50 GMT

I can't speak for Palo Alto, but I know a lot of vendors frown upon using HA across a WAN link.

Re: HA setup doc

usvi — Sat, 23 Mar 2013 22:58:35 GMT

Hey,

No . Thanks