topic HA Active/Passive MAC address in General Topics

HA Active/Passive MAC address

KumarRamalinga — Thu, 16 Aug 2018 18:07:23 GMT

Hello - In PaloAlto 5220 appliance configured in Active/Passive mode, both the Firewalls do have the same MAC address on interfaces. For example ETH 1/1 of active and standby Firewall have the same MAC address after cluster/HA was created.

These the switchport connecting the StandbyFirewall doesnt learn the MAC address of the Paloalto interface.

From switch what is the way to know the MAC and ARP of the secondary firewall interface?

Thanks/RB

Re: HA Active/Passive MAC address

gwesson — Thu, 16 Aug 2018 18:10:43 GMT

The MAC address is the same, as you've noted. The switch will learn of the passive only if a failover happens, at which point the (formerly passive) firewall will send a gratuitous ARP which will tell the switch to forward packets on the new port even though the IP and MAC are the same.

https://live.paloaltonetworks.com/t5/Management-Articles/Gratuitous-ARP-in-HA-Failover/ta-p/62781

Re: HA Active/Passive MAC address

RobinClayton — Fri, 17 Aug 2018 10:36:05 GMT

One thing to note as it's sort of relevant...

Never copy your HA Config to another firewall on your network without removing all the HA configuration. Otherwise bad things happen!

Rob

Re: HA Active/Passive MAC address

KumarRamalinga — Fri, 17 Aug 2018 17:51:45 GMT

Thanks for letting us know