topic Redundant links in General Topics

Redundant links

proscar — Mon, 03 Sep 2012 21:08:21 GMT

Hello,

I have a L3 deployment, and I need to support a link fail, Aggregate interface is not a solutions since QoS is not supported in aggregate interfaces, the firewall will be connected to the switch core but STP dont work in PA firewall. How can I get a redundant link maybe in physical layer with support for QoS?

thanks in advance

Re: Redundant links

mikand — Tue, 04 Sep 2012 12:08:27 GMT

Even if PA on itself doesnt (yet?) support STP (spanning tree) - shouldnt a L2 interface still forward the STP-packets?

I mean if you setup int1 and int2 as L2 (on the PA), connect a vlan-interface to int1 and int2 (within PA) - then the switch which is connected in the other end (running STP) should be able to disable the interface who is causing the loop?

Re: Redundant links

jvalentine — Tue, 04 Sep 2012 14:45:57 GMT

This is correct. I've had a chance to try this in the lab and it works well. In order to do this you'll need to use ports in Layer2 mode, and then use a VLAN interface for your routing. Physically, you'll be creating a loop in the network, but the switch(es) connecting into the Palo Alto Networks firewall will be running STP, and will prevent the loop from occuring.

Failover isn't the quickest @ 30-seconds, but it does work well.

See this thread:

Re: Redundant links

proscar — Tue, 04 Sep 2012 15:19:19 GMT

I have this deployment (attach) and it's necessary in L3 (requirement), by other side, it's correct connect back to back the PA or it's neccesary to place a switch?