topic HA and stateless connections... in General Topics

HA and stateless connections...

scantwell — Fri, 21 Dec 2012 18:37:20 GMT

Ok, I have what may be a newbie type question, but it is one that I wanted to ask.

In the PA 201 class, they teach for HA, that stateless connections are not synched.

What is considered a stateless connection? I do not think it would be UDP traffic (although this comes to mind), but if I am running a audio or video call to the Internet, it is going to use H323 traffic, which is RTP traffic (UDP).

If the FW fails over, I would not expect my video or audio call to drop completely or need to reestablish it.

So perhaps someone can help me better understand what this means, so I can explain it to my team.

Thanks

Re: HA and stateless connections...

mikand — Sun, 23 Dec 2012 14:39:36 GMT

Generally speaking I think its UDP (but not all) based traffic and stuff that uses ICMP.

For example even if UDP strictly speaking is stateless the layer7 applications using UDP can still contain various states like when using VoIP, TFTP, DNS etc.

I mean a DNS reply shouldnt be the first packet between two hosts on specific ports, first there should have been a DNS request.

Re: HA and stateless connections...

scantwell — Tue, 19 Feb 2013 16:27:27 GMT

Do we have any other information out there (maybe from tech support, engineering, etc) who can provide a more accurate answer. Much appreciated.

Re: HA and stateless connections...

gafrol — Tue, 19 Feb 2013 17:06:52 GMT

Re: HA and stateless connections...

mbutt — Tue, 19 Feb 2013 19:35:56 GMT

Hi,

All the sessions in the session tables are synchronized with the exceptions of following:

In Active/Passive mode, ICMP sessions are not synchronized between peers.

In Active/Active mode, Multicast sessions are not synchronized between peers.

https://live.paloaltonetworks.com/docs/DOC-4375

Thank you

Numan