topic Re: PA500 HA with Layer 3 OSPF connectivity to Core in General Topics

PA500 HA with Layer 3 OSPF connectivity to Core

Huddlebuy — Fri, 30 Nov 2018 18:14:34 GMT

We currently have 2 PA 500 which are currently configured for HA. But don't think its currently setup correctly.

This is what I can find regarding as to what we want to achieve.

Active passive with OSPF

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000CyRYAA0&field=Attachment_1__Body__s

But the above article doesn't really make sense, like on the widget display it says HA peer's IP used is 1.1.1.4 and 1.1.1.15.

Kind Regards

Re: PA500 HA with Layer 3 OSPF connectivity to Core

BPry — Fri, 30 Nov 2018 18:37:14 GMT

@Huddlebuy,

What exactly is confusing you in the document you linked to?

As for the IPs, if these units are directly connected it doesn't matter what IP you are using; the documentation should have used RFC1918 addresses in its example, but a lot of older docs used 1.0.0.0/8 addresses as it was assigned for research for the longest time and didn't actually matter. In your environment, these IPs should be something local to your environment.

Re: PA500 HA with Layer 3 OSPF connectivity to Core

Huddlebuy — Mon, 03 Dec 2018 11:15:34 GMT

Yeah that makes sense. Does the device priority need to be same on both devices? disabling Preemption ?

Kind Regards

Re: PA500 HA with Layer 3 OSPF connectivity to Core

OtakarKlier — Mon, 03 Dec 2018 16:47:38 GMT

Hello,

I would not make them the same. It is there to prevent split brain.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/device-priority-and-preemption

I have preemption disabled to prevent a flapping scenario. If there is a failover event, I want the standby unit to stay active until I can determine why it occured. In the older code and models, I had it enabled and it caused a flapping where they would see a failure and constantly flip back and forth and cause downtime for me. It was a weird scenario that I have only faced once however.

Regards,