topic Re: HA not working with interface monitoring any in General Topics

HA not working with interface monitoring any

NetworkGeek — Sat, 11 Mar 2017 14:28:28 GMT

Hello all,

i configured HA between paloalto peers , and HA failover as default without definig specifc interfaces and left it to "any"

when interface of inside zone shutdown from switch side , failover will not be trigered ? and need to fix it

Re: HA not working with interface monitoring any

TranceforLife — Sat, 11 Mar 2017 15:47:35 GMT

Hi,

Did you create a Link Group and assign interfaces there? Looks to me that failover conditions were not met:

https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/framemaker/70/pan-os/pan-os/section_5.pdf

Re: HA not working with interface monitoring any

NetworkGeek — Sat, 11 Mar 2017 17:01:07 GMT

Ok working now , but what is meant by failure condition (ANY) at link monitoring ?

Re: HA not working with interface monitoring any

NetworkGeek — Sat, 11 Mar 2017 17:30:28 GMT

Ok i undersatnd now ..

Any means any "Group" and inside each group there is other ANY which means any interface inside group

But new question , failure of HA links didn`t trigger failover ??

Re: HA not working with interface monitoring any

TranceforLife — Sat, 11 Mar 2017 18:44:48 GMT

Heartbeat Polling and Hello messages:

The firewalls use hello message and heartbeats to verify that the peer firewall is responsive and operational. Hello messages are sent from one peer to the other at the configured Hello Interval to verify the state of the firewall. The heartbeat is an ICMP ping to the HA peer over the control link, and the peer responds to the ping to establish that the firewalls are connected and responsive. By default, the interval for the heartbeat is 1000 milliseconds. A ping is sent every 1000 milliseconds and if there are three consecutive heartbeat losses, a failovers occurs. For details on the HA timers that trigger a failover, see HA Timers.

As we can see it is one of the conditions, so it will trigger failover (if you do not have a backup link configured). If both HA Control link and backup links fails failover occurs:

But l am not sure what will happen if HA Datalink fails. Let see for others replies

Re: HA not working with interface monitoring any

NetworkGeek — Sun, 12 Mar 2017 05:47:15 GMT

Thank You

Re: HA not working with interface monitoring any

Mehul_Pathak — Sat, 10 Oct 2020 01:31:21 GMT

In the virtual deployment I do not have access to any upstream device to trigger the link failure scenario - how do I test if the link monitoring configuration is working or not? Can I turn the Firewall interface into 'shut' mode to trigger the failover?