topic Re: Removing peer from HA cluster in General Topics

Removing peer from HA cluster

Joel_Abney — Tue, 28 Nov 2017 15:20:25 GMT

I have a pair of PA-3020s running 7.1.x in HA configuration. I need to remove the passive switch from the rack to be used in another location. What is the best way to disable the HA and delete the config from the active switch without risk of service interruption. Thanks in advance.

Re: Removing peer from HA cluster

Brandon_Wertz — Tue, 28 Nov 2017 15:44:43 GMT

@Joel_Abney wrote:
I have a pair of PA-3020s running 7.1.x in HA configuration. I need to remove the passive switch from the rack to be used in another location. What is the best way to disable the HA and delete the config from the active switch without risk of service interruption. Thanks in advance.

You have A/P and want to move the P firewall to another physical location?

Re: Removing peer from HA cluster

Joel_Abney — Tue, 28 Nov 2017 15:53:05 GMT

Brandon,

Correct. We are re-purposing the device so need to remove HA config from from both FWs but also break the HA connection without creating an outage.

Re: Removing peer from HA cluster

Brandon_Wertz — Tue, 28 Nov 2017 16:09:01 GMT

I would go to your passive device and "suspend" it

This tells your passive device to be non-functional.

I would then disable the physical ports. Then I would physically remove them. (HA included). Then go into your primary device and disable HA services.

With the previously passive device on a bench / lab connect the FW to you a computer and remove the HA and make any necessary config changes to the passive device.

*I'm not a Palo employee, I'd validate any procedures if you're planing work / projects on these procedures.*

Re: Removing peer from HA cluster

BPry — Tue, 28 Nov 2017 18:17:03 GMT

@Joel_Abney,

What @Brandon_Wertz is proposing should work perfectly fine. The only thing that might take into account is that the MAC will likely revert to the original interface MAC address if using L3 interfaces. The device would send out multiple gratuitous ARPs just like it does the first time though, so the MAC/IP listing should be updated fairly quickly.