topic HA Active/Active and VPN in General Topics

HA Active/Active and VPN

sajidsil — Thu, 12 Jul 2018 23:02:44 GMT

Hello,

We have a scenario where a customer wants to deploy two PA3250s in two different locations which will be an Active/Active cluster. There will be a layer 2 link between the two sites and also customer wants a VPN as a backup if the layer 2 link goes down.

Is this possible? How can we implement this if possible?

Thanks.

Re: HA Active/Active and VPN

Alex_Samad — Thu, 12 Jul 2018 23:43:04 GMT

I've done this with 5220 and HA.

create VIP and share them between HA.

So GP portal is HA'ed between the 2 nodes

node1 has gw1 with a vip that is available on both

node2 has gw2 with a vip that is available on both

But you have to use a min of 8.0.11 as there is an issue with HA and GP and some packets not crossing HA3 - i had this issue for quiet a while

Re: HA Active/Active and VPN

sajidsil — Fri, 13 Jul 2018 07:24:41 GMT

Thank you for your reply. In my scenario it is a site to site VPN between the two sites.

Re: HA Active/Active and VPN

Alex_Samad — Fri, 13 Jul 2018 07:27:47 GMT

haven't done ipsec tunnels. but my understanding is that GP using ipsec underneath.