topic Re: PA-5220 AUX ports for HA1 + HA1 backup in General Topics

PA-5220 AUX ports for HA1 + HA1 backup

Alex_Samad — Fri, 30 Jun 2017 22:01:06 GMT

Tried to setup a PA-5220 cluster and I can't get HA1 and HA2 to talk over AUX1 + AUX2

is it possible ? The GUI allows me to pick the interface.

Alex

Re: PA-5220 AUX ports for HA1 + HA1 backup

nextgenhappines — Sun, 02 Jul 2017 16:43:22 GMT

Hi,

HA2 is a 40G interface, I don't believe you can use the AUX2 (1gig interface to take over the built in HA2).

However, I did that in the lab to use AUX1 instead of the built in HA1.

-- Followed admin guide and found that aux-1 interface needs to be assigned ip under tab Device > Setup > Interfaces > aux-1.
-- Added IP-Address, Default Gatgeway and allowed ping service.
-- Selected aux-1 under Device > High Availability > HA1. Commit is successful this time.
-- Also, guided how to check interface setting on CLI for aux-1 by running below CLI command,

> show interface aux-1

hope this helps,

Re: PA-5220 AUX ports for HA1 + HA1 backup

Alex_Samad — Sun, 02 Jul 2017 21:30:23 GMT

My miss type

HA1 and HA1 backup ... not HA1 and HA2

For note my HA2 is using eth6/7 for 10G

my ha3 is using the 2xQSFP

Re: PA-5220 AUX ports for HA1 + HA1 backup

adhanapal — Fri, 25 May 2018 18:04:50 GMT

Hi Alex,

I have configured HA active/passive using aux port successfully. Initially, I got an error as

" High-availability ha1 IP information will use interface IP information if port is 'aux-1. Please remove IP information from ha1(Module: ha_agent)
Error: HA1 Port is not configured

Error: ha configuration error"

Then I have enabled the AUX port and assigned IP address, subnet mask and default gateway (if required). As per the previous discussion.

Then I tried by removing IP from Control Link (HA1) and Control Link (HA1 Backup). Then I was able to commit successfully and verified the HA status, it seems to be properly synchronized. Since both Control Link (HA1) and Control Link (HA1 Backup) taken the IP information from the AUX port.

Thanks & Regards,

Amarnath Dhanapal

Re: PA-5220 AUX ports for HA1 + HA1 backup

BPry — Mon, 28 May 2018 18:51:33 GMT

@adhanapal,

This trips up a lot of people that run the 5200 series firewalls, however as you've noticed you've found the proper configuration. When using the AUX ports you simply configure the IP information on the ports themselves, the HA information can be left blank as it'll use the information you suplied within the AUX setup.

Re: PA-5220 AUX ports for HA1 + HA1 backup

BigPalo — Wed, 08 Jul 2020 09:41:26 GMT

Hi Bpry,

We have configurar a PA 5260 in order to use the AUX ip to contact (services routes AUX int) with panorama, but when we register the FW in panorama is added with IP MGMT FW IP. why? its that normal?