topic Re: HA active/passive OSPF design in General Topics

HA active/passive OSPF design

tirexxerit — Thu, 23 Aug 2018 11:48:12 GMT

Hi,

Following topology is from PAN's design guide for A/P OSPF setup.

I wonder if it brings any benefit to connect firewall1 to Edge Router B and

Firewall 2 to Edge Router A with additional cabling run OSPF there too.

The only thing I can see is that there won't be a firewall failover but routing protocol

will re-route the traffic via RouterB if RouterA is in trouble and vice versa.

thanks for your feedback in advance.

Re: HA active/passive OSPF design

JoeAndreini — Thu, 23 Aug 2018 12:01:10 GMT

With the topology in the diagram, you would need link and path monitoring to force a failover in the event of a router failure (internal or external)

Your proposed physical links could remove that requirement, given you have enough interfaces to support it.

I do not know offhand why PAN suggests this topology over your proposal.

Re: HA active/passive OSPF design

tirexxerit — Thu, 23 Aug 2018 12:16:56 GMT

Link and path can be monitored but which one would be faster and with less outage considering we follow the HA best

practices.

If OSPF is involved with dual links then there should be BFD for a quick failover in case the neighbor goes down as well.

I need to dig more and do some tests.

thanks.

Re: HA active/passive OSPF design

OtakarKlier — Thu, 23 Aug 2018 14:30:15 GMT

Hello,

From my experience the failover has been pretty quick. The HA is usually without drops ( i used to vpn into an HA pair and perform upgrades and never lost VPN connection). As for OSPF its pretty quick as well. I have seen anywhere from 3-7 ping drops during the failover.

I guess it all depends on your companies pain tolerance during a failover event. I think the guide was written with using as few interfaces as possible. The other thing you have to remember is asymetric routing where the routers are concerened if you are pluggin into both of them. You would then need to add weights to the connections so asymmetry doesnt happen.

Just some thoughts.

Re: HA active/passive OSPF design

tirexxerit — Thu, 23 Aug 2018 15:04:40 GMT

The thing is that outage during a planned upgrade is usually less than

an event causing an outage. At least from our experience:) otherwise during a planned upgrade and failover

it is mostly pretty seamless 1-2 ping loss and no session drop.

Involvement of BFD, Graceful restart greatly impacts too but I think setting which can work for one expected event

may not work for another.

Thanks for your thoughts, much appreciated.