topic Re: Hardware failure recovery in an HA pair in General Topics

Hardware failure recovery in an HA pair

jdprovine — Fri, 21 Dec 2018 14:41:39 GMT

What is the best way to recover the primary PA 5050 if the hardware completely dies?

Re: Hardware failure recovery in an HA pair

Raido_Rattameister — Fri, 21 Dec 2018 16:05:20 GMT

Well I guess that second firewall took over.

So when you get new hardware then configure mgmt interface, HA settings and from firewall that has config you sync to peer.

Also Link and Path monitoring needs to be configured on both firewalls seperately.

Are they in Panorama?

Re: Hardware failure recovery in an HA pair

jdprovine — Fri, 21 Dec 2018 16:11:55 GMT

@Raido_Rattameister

Yes I would assume that the secondary would take over to, this hasn't actually happened I was thinking about the best way to deal with it. So you would let the secondary sync to the new hardware?

No panorama

Re: Hardware failure recovery in an HA pair

Raido_Rattameister — Fri, 21 Dec 2018 16:14:57 GMT

Yes that is all you have to do.

But be careful. Sync to peer is available on both firewalls. If you accidentally click on it on the empty firewall then empty config is pushed to other one and your environment will go down 🙂

Re: Hardware failure recovery in an HA pair

jdprovine — Fri, 21 Dec 2018 16:44:27 GMT

@Raido_Rattameister

So did you make new hardware the secondary or the primary again. Recently PA TAC told me to disable sync to peer on the secondary

Re: Hardware failure recovery in an HA pair

Raido_Rattameister — Fri, 21 Dec 2018 16:46:51 GMT

If one firewall fails then you replace it, set up management, ha, path and link monitoring.

Make sure to set ha priority higher number on new firewall so it would not become active with empty config.

Log into old firewall and click sync to peer.

Done

Re: Hardware failure recovery in an HA pair

jdprovine — Fri, 21 Dec 2018 17:14:33 GMT

@Raido_Rattameister

So you would bring the replaced one back on as the primary again? We only have 2 PA's and primary and a secondary.

Re: Hardware failure recovery in an HA pair

Raido_Rattameister — Fri, 21 Dec 2018 18:53:43 GMT

Let's assume you call them primary and secondary.

Primary is active.

Primary fails.

Secondary becames active.

You RMA the hardware.

Configure settings on new primary.

If it becames acitve before you have synced config from secondary then your environment goes down.

So initially you have to have HA priorithy higher number on new primary compared to secondary so it would not become active.

After sync to peer you can change priority settings so that new primary becomes active again.