topic Re: PA3220 HA Trigger Condition in General Topics

PA3220 HA Trigger Condition

Putmano — Fri, 19 Oct 2018 14:27:26 GMT

I have a pair of PA3220 firewalls in my environment. I configured Active/Passive for High Availability and I configured Link Monitoring condition to trigger the failover. However I'm still not clearly understand the behavior of PA HA.

I configured a Link Monitoring Group on both Firewall as below

- Name INSIDE

- Condition ANY

+ Interfaces E1/1

+ Interfaces E1/2

I tried to disconnect the E1/1 on PA01 and the failover triggerd(active on PA02). Then I disconnected the ports E1/1 and E1/2 on PA02. The active state still on the PA02 even the port E1/1 on PA01 UP. I'm not sure, does PA compare the link status between HA?
HA

Re: PA3220 HA Trigger Condition

OtakarKlier — Fri, 19 Oct 2018 18:31:49 GMT

Hello,

Where are the e1 and e2 interfaces in your diagram. Also are all 4 of those devices firewalls? Just trying to get the bigger picture.

Regards,

Re: PA3220 HA Trigger Condition

reaper — Fri, 19 Oct 2018 21:52:55 GMT

Have you combined both interfaces in the same group ( as the group will carry the same 'weight' if one interface is down or all of them)

in your scenario, I think you'll need to create 2 groups: each with 1 interface

Re: PA3220 HA Trigger Condition

Dali_Chauhan — Tue, 23 Oct 2018 14:46:03 GMT

Hi,

Can you elaborate the scenario again as it seems very confusing. Ideally this should not happen . Please re-check configuration and priority on PA02 link interface , priority difference could be the reason for this.

You can also check HA logs to get the exact reason for this behavior of PA-HA.