topic Re: FAIL OVER SWITCHs in General Topics

FAIL OVER SWITCHs

Thiago — Tue, 03 Apr 2012 15:06:58 GMT

Hi guys ,

i want to explain my problem.

I have a 2 switches in fail over with link aggregate with 3 vlan`s. (LAN , SAN , Management)

I have one PA-500.

How can i configure my PAN interfaces , when 1 switch fail , the 2 switch get all flow and my firewall need to answer my requests. PAN 500 is my Default gateway on my LAN , SAN , Management

In this picture we can understand better my toplogy http://www.google.com.br/imgres?q=Firewall+with+2+switches&um=1&hl=pt-BR&client=safari&rls=en&biw=1279&bih=629&tbm=isch&tbnid=FSa41HBMmBJErM:&imgrefurl=http://www.juniper.net/techpubs/en_US/junos9.3/topics/concept/firewall-filter-ex-series-understanding.html&docid=6H5oVIVFwcHFrM&imgurl=http://www.juniper.net/techpubs/images/g020007.gif&w=588&h=501&ei=bRF7T-uQFcm5tgf_hvC_CA&zoom=1&iact=hc&vpx=583&vpy=206&dur=9976&hovh=207&hovw=243&tx=119&ty=75&sig=110041051692503370556&page=3&tbnh=145&tbnw=170&start=44&ndsp=24&ved=1t:429,r:15,s:44

best Regards

Thiago Lima.

Re: FAIL OVER SWITCHs

rmonvon — Tue, 03 Apr 2012 16:37:20 GMT

Hi...You can configure two L2 interfaces on the PA500 with L3 forwarding and VLAN tagging to support your VLANs. Define virtual L3 interfaces, one per VLAN, which will act as the default gateway for all users/devices.

Since you have 2 switches for failover, you should consider adding a 2nd PA500 for high availability. Otherwise if the PA500 is unavailable, your services will be interrupted.

Thanks.

Re: FAIL OVER SWITCHs

Thiago — Tue, 03 Apr 2012 18:03:06 GMT

About port channel , it`s possible to do ? with cisco ?

Best Regards.

Thiago Lima.

Re: FAIL OVER SWITCHs

mikand — Tue, 03 Apr 2012 19:28:13 GMT

Yes you can do port aggregation between PAN and a switch.

For example following setup:

PAN1 - 2 cables - SWITCH1

PAN2 - 2 cables - SWITCH2

SWITCH1 - 2 cables - SWITCH2

See following threads for more info regarding aggregated interfaces:

Aggregation of ethernet on PA-4050 with Cisco switch
https://live.paloaltonetworks.com/message/2388#2388

PA 5050 Aggregate Interfaces
https://live.paloaltonetworks.com/message/13551#13551

Re: FAIL OVER SWITCHs

rmonvon — Tue, 03 Apr 2012 20:14:19 GMT

The PA500 does not support link aggregation at this time. Thanks.

Re: FAIL OVER SWITCHs

Thiago — Tue, 03 Apr 2012 20:16:14 GMT

Only 4000 Series and 5000 Series Support Port Channel ?

Best Regards.

Thiago Lima.

Re: FAIL OVER SWITCHs

rmonvon — Tue, 03 Apr 2012 20:17:22 GMT

Correct.

Re: FAIL OVER SWITCHs

mikand — Tue, 03 Apr 2012 20:21:51 GMT

oops...

Re: FAIL OVER SWITCHs

Thiago — Tue, 03 Apr 2012 20:26:45 GMT

?????

Re: FAIL OVER SWITCHs

mikand — Tue, 03 Apr 2012 20:28:58 GMT

I had missed that currently only 4000 and 5000 series support aggregated interfaces.