topic Re: Pannorama and HA Cluster in General Topics

Pannorama and HA Cluster

minow — Tue, 29 Oct 2013 13:15:10 GMT

Hey

i would like to know how the commit process works when i push commit on pannoaram to HA device group.

1) does Panorama send the configuration to both of the device and then commit it?

2) does Panorama send it only to one device and it commits it to the other device?

i have a situation of a PA HA cluster, and only one device was inserted to the Panorama and the result was that both of the device were synced but the policy was actually exists on one of the devices and on the other device there was no policy. from this i assume that panorama probably insert the serial number of the "to be deployed" PA device when it sends the policy to the device,

i would like see the white papers of this process

thank you

dor

Re: Pannorama and HA Cluster

shasnain — Tue, 29 Oct 2013 13:38:06 GMT

Hi,

You would have to add both the serial numbers of the HA member device in order to push the config to them from the Panorama. If you send the configuration from the Panorama to only one device , the Panorama pushed config does not sync up between two HA pairs. You can add the two devices in one device group and pushed the configuration to them.

Re: Pannorama and HA Cluster

minow — Wed, 30 Oct 2013 12:12:21 GMT

What about if i have HA Cluster and i do service route for the Panorama through the untrust interface?

Panorama will see both of the device with the same IP right? so how will the configuration be pushed to both of the devices?

Re: Pannorama and HA Cluster

ssharma — Fri, 01 Nov 2013 14:14:32 GMT

If you use untrust interface of the device as service route, the configuration will be pushed only to active device (assuming policies are configured correctly) because only 1 ip is active at a time for active/passive, even though you have same ip on both device. Suggested configuration would be to use management interface itself. Since management ip address are unique for both device, you will not have any issues and will prevent extra bandwidth consumption on untrust interface.

Hope this helps.

Re: Pannorama and HA Cluster

minow — Sun, 03 Nov 2013 08:22:23 GMT

it depands.... because panorama will also manage PA device through VPN S2S and that will make my the connection between the panorama and the device rely on the VPN conneciton, so i cannot really move all the functionality from the device to the panorama

i would like to see that ability that Panorama will push the configuration to the active one and then the policy will be synced to the other one...

this is already done when i change for example the Interface of one PA device and push commit, the changed will also be done on the other device because most of the configuration are global to the HA Cluster, then the configuration can be done on a shared template for both of the device and specific configuration will be done on the device. (in all cases i am talking on active passive cluster)

Re: Pannorama and HA Cluster

shasnain — Mon, 04 Nov 2013 15:01:53 GMT

Panorama pushed config does not sync over from the Active PA to the Passive PA.