topic Re: pa200 ha in General Topics

pa200 ha

Buccaneer — Mon, 14 Jan 2013 17:53:23 GMT

Im in the process of setting up a pair of pa200 for ha, ive read through the documentation but im not clear on a few things.

The PA200, if i do an update on the FW for either software of dynamic updates it uses the management port to do the work.

If I configure HA I will need to use the management port and one of the ethernet ports, the other three are allocated with eth1 being used for the WAN link.

If i do a software update, do I need to make a configuration change to get the FW to initiate the update from eth1 rather than the in use management port.

Re: pa200 ha

sdurga — Mon, 14 Jan 2013 17:57:33 GMT

no you can still use the mgmt port for software upgrades while using it as a part of ha !!

Re: pa200 ha

Thiago — Mon, 11 Mar 2013 19:08:39 GMT

Hi guys , its possible to do a HA with PA-200 right ?

This HA just to syncronization configuration , policies and networks ?

Best regards.

Re: pa200 ha

ericgearhart — Mon, 11 Mar 2013 19:12:57 GMT

Yes I believe it is called "HA Lite":

HA Lite offers the following capabilities:

Fail-over of IPSec Tunnels
DHCP Lease information
PPPoE lease information
Configuration sync
Layer 3 forwarding tables

The big difference is that HA lite doesn't provide session syncronization.

Re: pa200 ha

gsteiner — Thu, 19 Sep 2013 08:34:42 GMT

I configured ha-lite on two pa-200 but when doing so i lost functioning of my eth4 interface which is connected to the internet. All other interfaced worked normaly..even a sub interface on eth4 worked.

Is this because i have Feature GlobalProtectGateway enabled on this interface?

Re: pa200 ha

UhMayYeah — Thu, 19 Sep 2013 09:33:15 GMT

If by losing the interface, you mean accessing HTTPS service on eth1/4. You need to access this interfaces on port 4443

How to Access the WebUI when GlobalProtect Is Enabled

Re: pa200 ha

rmonvon — Thu, 19 Sep 2013 12:30:15 GMT

When HA is enabled for the 1st time, the MAC address on the Eth interface changes to a virtual MAC that can be used by both PA's. Maybe this happens and your ISP router need to refresh its ARP table?

Re: pa200 ha

ericgearhart — Thu, 19 Sep 2013 13:39:31 GMT

rmonvon: I thought the PA will send out a gratuitous ARP when any HA events take place, in order to "push" the change to any devices that might have an old MAC address cached in their ARP tables

Re: pa200 ha

gsteiner — Thu, 19 Sep 2013 18:56:37 GMT

Well then i would loos the DHCP Information or would they stay? I can do a DHCP Renew and get the IP.

It's really strange, everything looks normal...routing everything...but ping 8.8.8.8 goes now to nirvana....maybe it's realy the isp router...problem is that i can't reboot that from remote..

Re: pa200 ha

gsteiner — Thu, 19 Sep 2013 19:04:36 GMT

Correct!

sh mac adderss-table inter gi1/0/4

it list a new mac address.....shit....Thanks for help

Re: pa200 ha

rmonvon — Thu, 19 Sep 2013 23:35:22 GMT

egearhart...Yes, you are correct and the PA would issue a gratuitous ARP upon changing to the virtual MAC. However, I have encountered a number of routers, including Cisco, that will not update and they retain the previous MAC address.

gsteiner...:-)

Re: pa200 ha

gsteiner — Fri, 20 Sep 2013 11:05:54 GMT

it didn't work...i tried it again...i enabled the cluster then i rebooted the ISP Modem after 3 min i got a new IP Address (DHCP).

I see the traffic in Monitor but application is everything "incomplete" and it dosn't work anymore.....as soon i disable Cluster and commit it works as allways...

Anyidee why HA-Lite dosn't work with a DHCP Device????

It worked on a PA500 without problems.....

Re: pa200 ha

Retired Member — Sat, 21 Sep 2013 20:48:00 GMT

How is your eth4 configured ? you said subinterface works, you already have subinterfaces or just for trying purpose you added ?

Did you try to access from your eth4 ip to default gateway and internet for troubleshoot better.

using ping source eht4/ip host destination_ip