topic Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones in General Topics

PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

nawaza — Tue, 06 Feb 2018 20:06:52 GMT

Hi folks

Have pair of 5220s in Active/Passive HA. I'm reading that multiple zones cannot be used on VWire, well actually i'm finding that documentation not so clear and it could be functionality added in later releases of code.

Anyway let me try to explain. I wish to bond (AE) eight + eight 10Gig interfaces to forming a single 80Gig VWire. Each end of the VWire will physically attach to Cisco switch capeable of LACP if needed.

Once the single VWire is set-up, can multiple Subinterfaces and Zones be configured and allocated across different vSys's?

Many thanks

Ajaz Nawaz

JNCIE-SEC No.254

CCIE-RS No.15721

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

reaper — Tue, 06 Feb 2018 21:25:31 GMT

hi @nawaza

yes, you can create (vwire) subinterfaces and then you will be able to configure unique zone pairs for each subinterface

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

nawaza — Tue, 06 Feb 2018 23:25:41 GMT

Oh cool and please can I ask about LACP...

I mean is it configured on the Palo in such a setup?

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

OtakarKlier — Tue, 06 Feb 2018 23:56:12 GMT

Hello,

Yes there is a way. Check these out and let us know if they help.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Which-Link-Aggregation-Protocols-are-Supported/tac-p/58065#M565

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/high-availability/ha-concepts/lacp-and-lldp-pre-negotiation-for-activepassive-ha

Cheers!

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

nawaza — Wed, 07 Feb 2018 10:59:50 GMT

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

nawaza — Wed, 07 Feb 2018 11:01:45 GMT

FWs are in HA Active/Passive as stipulated in OP

This will be interesting, if it works...

Re: PA-5220s Active/Passive HA with Single VWire but multiple vSys's and Zones

OtakarKlier — Wed, 07 Feb 2018 22:40:42 GMT

Please post your results. Its an interesting scenario for sure and a lot of bandwidth :).