topic OSPF multipath L2 FIP in General Topics

OSPF multipath L2 FIP

migration — Fri, 02 Mar 2012 22:09:56 GMT

Hi,

We recently purchased two PAN 5020 Firewalls. I had two easy questions. We were wondering if they support OSPF multipath path (either equal cost or unequal cost).

I was also wondering if I can configure muliple Floating IP address in the L2 mode? Does it matter if I'm in Active Active or Active Passive?

Thank you

Re: OSPF multipath L2 FIP

jhansf5 — Sat, 03 Mar 2012 01:42:18 GMT

They do not support OSPF multipath - they will install only one route.

Can't help with the second question, but I'm sure someone that has deployed in L2 can chime in.

Re: OSPF multipath L2 FIP

mikand — Sat, 03 Mar 2012 09:41:52 GMT

According to:

https://live.paloaltonetworks.com/message/10099#10099

and

https://live.paloaltonetworks.com/message/7904#7904

it seems that PAN currently doesnt support ECMP (Equal Cost MultiPath). But I think it should support "unequal" multipaths since this is the base of most dynamic routing protocols (only the "best" route will be loaded into the fabric and when this route fails the dynamic routing engine will select next route and load that into fabric).

So your best choice is to contact your sales rep. and issue this as a feature request (dont forget to return to this thread with an update on how it goes).

Regarding floating ip's those are only available (to my knowledge) in active/active setups.

That is because in active/passive its the very same config thats loaded in both devices (and the unit who is currently passive is simply virtually shutdown except for the mgmt interface and HA-links). While in active/active both devices must be online and VRRP (or similar) is being used (each unit have a physical IP address and then shares one or more floating IPs).