topic Re: PA firewalls and HA across different GEO locations in General Topics

PA firewalls and HA across different GEO locations

NavidAlam — Wed, 23 May 2018 12:28:08 GMT

Hi Support,

We have Client in Cork want to know about the FW HA across Different Location.

What are requirements for having fw cluster spread across different GEO locations (latency, delay, etc)?
Is this recommended at all by PA? If yes, what kind of link is required for HA connectivity (L3, L2)?

We have some ideas of spreading current firewall cluster between new Data Cente in Dublin and DR site different location.

Is it not good idea because of possible split brain scenarios due to periodical link latency.

Basically to take passive current FW appliance and rack it to different location so that active/passive cluster is spread .

Re: PA firewalls and HA across different GEO locations

BPry — Wed, 23 May 2018 15:27:11 GMT

@NavidAlam,

You can overcome any latency situation by adjusting the HA settings themselves, but I kind of have to ask why you would want to setup like this. Usually if you build out a different data center in a completely different location you utilize load-balancing or DNS changes to kick the traffic over when you need it. I've never seen anyone have such geographically diversified firewalls running in an active/passive pair; not because you can't do so, but why would you want to?

Re: PA firewalls and HA across different GEO locations

NavidAlam — Thu, 24 May 2018 07:55:42 GMT

It is not why i want . Client is asking if it is possible are not what it is the recommendation if we do ?

Second, if so what is the recommendation they asking is it safe or not due to a different location?

Does Palo Alto recommend or not if do not what is the normal recommendation

Re: PA firewalls and HA across different GEO locations

BPry — Thu, 24 May 2018 23:49:58 GMT

@NavidAlam,

Yes it's possible, the recommendation would be to set the HA timers with the time consideration that it will take to travel whatever distance you are putting them across. This will depend on the link and how long it actually is. You'll need to set the HA Timers to 'Advanced' and actually manually set these in accordance with the latency on this link.

This type of setup would not be recommended. You're essentially asking to seperate an HA Active/Passive pair over 260km and expecting it to perform well.

Re: PA firewalls and HA across different GEO locations

RobinClayton — Fri, 25 May 2018 16:17:12 GMT

My DR site is 5 miles away over a 1Gb fibre link, would not consider HA on that. We can manage most of the inbound trafic changes easily, and outbound does not matter.

Rob

Re: PA firewalls and HA across different GEO locations

AndrzejPiotrowski — Thu, 21 Sep 2023 05:58:22 GMT

Hi, this is interesting question. If I setup timers on HA communication to huge delay the cluster PA will be works? Is exist any official document on site palo alto?