topic High Availability Bandwidth / Latency Requirements in General Topics

High Availability Bandwidth / Latency Requirements

euanbarker — Thu, 21 Jan 2016 10:27:56 GMT

We are about to introduce a dual site DC setip with a single Internet IP address space available across both of them. We have a Multiple VLAN 100 Mbps fibre link between the sites and would like to split the PA-3020 pair we have running active/passive HA so there is one on each site. Latency between the sites is about 5 ms.

Questions -

What are the latency and bandwidth requirements for HA ? I cannot find anything detailing any specific requirements, guidelines or way of estimating likely bandwidth to be used

is this type of setup supported ?

Thanks

Euan

Re: High Availability Bandwidth / Latency Requirements

pankaku — Thu, 21 Jan 2016 11:04:30 GMT

Are you saying that one of the firewall will be on one site and another will be on another site?

You have to take care of the routing such that if one of the firewall fails then the traffic should pass through the other unit.

For stability of HA you can increase the HA timers. Value depends on distance between the unit, cables. You can check the latency and accordingly set the values.

Device>High Availability>General>Election setting> Select the advance option.

The default values are:

Hello interval - 8000ms.
Heartbeat interval - 1000ms
Preemption hold time - 1min
Monitor Fail Hold Up Time - 0ms

Hope this helps.

Re: High Availability Bandwidth / Latency Requirements

syadav — Thu, 21 Jan 2016 12:50:35 GMT

@euanbarker

Do you mean the bandwidth requirement for the communication between the HA1 and HA2 links of the HA ?

If yes, I dont readily see any document stating this information (it is tricky for the vendor to publish any specfic values).

The following DOC explains what is synchronized via which link (HA1/HA2). You will find that this is very less bandwidth intensive info (more than bandwidth, stablility and availability is important here)

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/documentation_tkb/568/1/HA_Synchronization_RevD.pdf

Also, since this is not a Active/Active setup, there is not transfer of actual traffic between the nodes (via HA3) which might have required high bandwidth (or aggregated )HA3 link.

Re: High Availability Bandwidth / Latency Requirements

euanbarker — Thu, 21 Jan 2016 13:24:49 GMT

Thanks for the quick replies.

I do mean the firewalls will be split with one at each site. We would run HA1 and 2 across vlan's using the 100 Mbps fibre link between sites which is a vlan trunk. I've read and reviewed the options for adjusting the timers to ensure stability and we have plans in place to ensure failover options mirror availability from outside the PA's through and to inside them so we don't get split brain situations at any point. The only bit that is unknown is what bandwidth the HA traffic will need. I know this is build and traffic dependant but some guidance would be useful.

We are going to measure stats on the HA1 and HA2 interfaces we have on the PA-3020 cluster while it's in the same location so we can have a benchmark to work from.

Thanks

Euan

Re: High Availability Bandwidth / Latency Requirements

syadav — Thu, 21 Jan 2016 13:29:25 GMT

@euanbarker Since you plan to have 100 Mbps links for HA1 and HA2, it should be more than sufficient. Had it been the HA3 link (if the setup was an A/A HA) the case would have required more pondering !

Re: High Availability Bandwidth / Latency Requirements

pankaku — Thu, 21 Jan 2016 13:40:20 GMT

100mbps is good no issue with that. You have to focus on the timers to avoid unnecessary failovers. In Active-Active HA3 need more bandwidth.

Re: High Availability Bandwidth / Latency Requirements

ET — Mon, 24 Nov 2025 16:17:32 GMT

So, What are the Latency / Bandwidth Requirements for HA1 interfaces links between 2 HA members?