topic Re: VLANs for HA links in General Topics

VLANs for HA links

AlbertJJ — Thu, 04 May 2017 00:50:13 GMT

Hi all,

I am configuring two PA 3060 in A/A HA across datacenter. All the HA links from a PA in a DC will be connected to the core switch. Is it possible to put all HA links, i.e., HA1, HA2, HA3, HA1-backup, HA2-backup, in a single VLAN? Or does each link needs a separate VLAN?

Thanks

Re: VLANs for HA links

P.Braat — Thu, 04 May 2017 07:18:59 GMT

As far as i know all HA links are expected to be in a sepperate ethernet segment. You can do this bij sepperate cables or bij seperate vlans for each ha type traffic. If you are stretching accros a data center, maybe it is wise to consider building the HA on L3 : L3 HA

hope this helps

Re: VLANs for HA links

Brandon_Wertz — Thu, 04 May 2017 17:36:36 GMT

Especially in a A/A enviornment would you want to deploy something which isn't considered "best practice" from a vendor?

I've never tried to use all connections on a single VLAN, but I'd suspect the FW would take the config.

The concern would probably be the vulnerability in collapsing everything into a single VLAN and the amount of traffic this would be.

Re: VLANs for HA links

BPry — Thu, 04 May 2017 19:28:30 GMT

I'm going to go with @Brandon_Wertz on this one. TAC generally doesn't love touching A/A configurations in my experiance, if you through this in the lope they are likely going to point to misconfiguration if you ever contact them on any issues with HA. I imagine that the firewall would except the configuration but it's likely just better to do it 'by the books' on this one to avoid any issues popping up.

Re: VLANs for HA links

AlbertJJ — Fri, 05 May 2017 00:16:31 GMT

I could not find anything in the guides that each of these links should be in a separate VLAN.

Sure my first though was to configure separate VLANs but wanted to know whether this will work without issues. Then there is TAC support issue!

Thanks all!