topic Re: HA active/passive with single HA port ? in General Topics

HA active/passive with single HA port ?

LCMember4717 — Mon, 19 Dec 2011 12:09:04 GMT

hi,

i have two PA500 appliances am looking to configure them on HA mode , with my current setup i have utilized all 7 ports so one port left for me , as per the documents for HA ( A/A , A/P ) you need 3 or 2 ports to achieve the configuration... so is there a way to achieve HA ( A/P ) with single HA port ? because if not i have to re-setup the appliance to free up two ports for HA :smileygrin:

Re: HA active/passive with single HA port ?

mharding — Tue, 20 Dec 2011 15:09:39 GMT

HA consists of two ports, the control (HA1) and the sessions (HA2). If you don't do HA2, all of the clients will have to restart their sessions if the box rolls. May or may not be a big deal.

You might be able to consolidate some of your interfaces with VLANs and trunk interfaces.

Re: HA active/passive with single HA port ?

rmonvon — Tue, 20 Dec 2011 21:02:06 GMT

We do not support having 1 HA port to handle HA1, HA2, and/or HA3. You need a dedicated Eth port for each HA link. You may want to try the consolidation method as suggested by umphmharding.

Thanks.

Re: HA active/passive with single HA port ?

jdavis — Tue, 20 Dec 2011 21:41:38 GMT

Have you successfully implemented this at your site or with any customers? I could see this as an option for some of my customers who run PA-500s.

Thanks,

Jared

Re: HA active/passive with single HA port ?

mharding — Tue, 20 Dec 2011 21:46:18 GMT

Just running HA1 or the VLAN part?

We ran with just one HA port during testing on our PA-2050s for a day way back on PAN-OS 2.1.5 or 2.1.4. I think there's been a lot of changes since then.

Re: HA active/passive with single HA port ?

rmonvon — Tue, 20 Dec 2011 21:50:43 GMT

Yes, HA is supported for the PA500 and we have customers using it. Just to be clear, you have to use 1 Eth port for each HA link.

Re: HA active/passive with single HA port ?

LCMember4717 — Wed, 21 Dec 2011 07:03:06 GMT

what if i created a subinterfaces or it requires physical dedicated interfaces , am thinink to create a vlan on the switch for HA sessions create subinterfaces from single interface tag them with vlan id ?

Re: HA active/passive with single HA port ?

mharding — Wed, 21 Dec 2011 13:59:13 GMT

The HA interfaces aren't L2 or L3 interfaces, they're special to the PAN. They'll have to be dedicated ports.