topic Re: A/A HA changes - looking for information on procedures in General Topics

A/A HA changes - looking for information on procedures

sam.mackenzie — Thu, 25 Feb 2016 10:59:49 GMT

Hi - looking to make some changes to the HA configuration between 2x PA 5000s.

First change: an HA3 link to an AE link on different interfaces in an A/A pair of 5000s.

I'm wondering if there is a procedure anywhere for this? What would happen to an A/A pair if HA3 were to be reconfigured by panorama? Connections are already in place just need configuring.

Is it recommended to remove Active/Active during the configuration? Is there a procedure for that anywhere 🙂

Any help would be greatly appreciated.

Thanks

Sam

Re: A/A HA changes - looking for information on procedures

Raido_Rattameister — Thu, 25 Feb 2016 15:52:13 GMT

What is your reason for using A/A? Asymmetric routing or Palos connected to another firewall cluster or something else?

HA3 is used to transmit packets between firewalls.

All packets belonging to same session are analysed by same firewall. If packet comes to firewall and session owner is other firewall then HA3 is used to pass packet over.

If you disconnect HA3 then you will disturb your connections anyway.

If you don't have specific requirement to have both boxes running all the time then suspend one and see if you can change HA3 interface.

If not then disable HA temporarily and make your change.

Re: A/A HA changes - looking for information on procedures

pulukas — Fri, 26 Feb 2016 01:38:10 GMT

This is a non-standard change so I don't think you will find it documented. And I suspect this will be service affecting and / or require suspending a node in the cluster.

For these types of activities, I generally open a support case. This way the MOP can be reviewed by some senior engineers and the outage scenario fully understood.

PA will also schedule a time to be live with you on a call from TAC during your maintenance window for these types of changes. This speeds the process and has them on standby if the MOP does not work out for some reason.

Re: A/A HA changes - looking for information on procedures

sam.mackenzie — Fri, 04 Mar 2016 09:53:24 GMT

Hi Both thanks for your answers.

I'll probably go down the road of raising a support call to assist in this.

If I learn the procedure, and remember I'll post it back here 🙂