topic Re: Active/Standby network design and usage as network gateway? in General Topics

Active/Standby network design and usage as network gateway?

jsalmans — Wed, 28 Nov 2018 20:41:58 GMT

I have some questions on the Active/Standby deployment model. Right now I'm on A/A which requires all network config between the two units to be different since they're both active at the same time. From looking at the documentation, it looks like in an A/S model the network config between the two units is identical which includes all of the same IP addresses on subinterfaces, virtual routers, etc. Is this correct?

If so, does the standby simply keep its interfaces shut while not active? During a failover scenario, does the switchover happen fast enough that dynamic routing protocols to not notice and therefore not require reconvergence?

I'm aslo wondering if anyone uses their firewalls for the L3 network gateways for any of their VLANs? I was considering setting up subinterfaces and maybe using them for our DC networks so that the firewall could more directly dictate for each server what it can and not have access to without doing ACLs on a Cisco switch or router. Alternatively, I'd probably use Policy Based Routing to push the traffic from the network's gateway to the firewall.

Re: Active/Standby network design and usage as network gateway?

OtakarKlier — Wed, 28 Nov 2018 20:51:00 GMT

Hello,

So yes to the first paragraph. And yes to keeping the interfaces in a shutdown state on the standby unit. I run A/S and dont have issues, I also run OSPF and it doesnt really mind much since the S has the sessions in it. I think last time I failed them over I maybe lost 1-2 pings. This is usually quick enough for dynamic routing since the timers are usually longer than that.

As for using the PAN as a L3 Vlan interface, I also do this since I can then segregate the traffic and get closer to a Zero Trust model. One thing I do is have one zone and carve it up into smaller subnets so that I dont run out of zones.

i.e.

zone ZeroTrust

IP subnets 192.168.0.0/24 then carve them up into /29's. Since I have a DENY ALL policy, the intra zone traffic doesnt take affect and the traffic has to be allowed between two subnets in the same zone.

Hope that makes sense.

Re: Active/Standby network design and usage as network gateway?

Raido_Rattameister — Wed, 28 Nov 2018 21:04:05 GMT

I use auto not shutdown.

In this case port is active it just drops any incoming packets.

Benefit is faster failover.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcACAS