topic Re: HA Link and Path Monitoring in General Topics

HA Link and Path Monitoring

JonHill — Mon, 14 Jan 2019 13:32:12 GMT

We've configured HA Active\Passive on a pair of 5250's running PAN-OS 8.1.5 and it works a treat and pre-emption also works as expected.

I've configured Link monitoring so if we get an HA failure if the trusted links fail which works and it fails over to the passive as expected but when the links come back it doesn't fail back again to the active unit.

Does Pre-emption work with Link and Path monitoring and if it does how is it configured?

Any help would be much appreciated.

Thanks

Jon

Re: HA Link and Path Monitoring

reaper — Mon, 14 Jan 2019 16:46:43 GMT

hi @JonHill

Pre-emption will wait an amount of time after a failover and then try to 'fall back' to the original setup

If after a configurable amount of retries the active device still has link monitor failures, the passive device will take over permanently until you manually fail over

Re: HA Link and Path Monitoring

OtakarKlier — Mon, 14 Jan 2019 16:46:50 GMT

Hello,

I take it you have it preemption enabled on both devices?

Preemptive—Enables the higher priority firewall to resume active (active/passive) or active-primary (active/active> operation after recovering from a failure. The Preemption option must be enabled on both firewalls for the higher priority firewall to resume active or active-primary operation upon recovery following a failure. If this setting is off, then the lower priority firewall remains active or active-primary even after the higher priority firewall recovers from a failure.

Re: HA Link and Path Monitoring

JonHill — Tue, 15 Jan 2019 08:42:06 GMT

As you say it was down to the speed at which I re-enabled the interfaces that it had permanently stayed with the peer.

Is there anyway of changing these timers and where do I find them?

Thanks

Re: HA Link and Path Monitoring

MP18 — Fri, 15 Feb 2019 21:03:03 GMT

for this we should have pre enabled on both active and passive right.

Our Active PA has priority 80 and passive has 100.

Link Monitoring is only configured on Acitve PA.

With this config when link on Active PA is down and passive should takover the active role untill link on Active PA is up right?

Re: HA Link and Path Monitoring

reaper — Fri, 15 Feb 2019 21:35:17 GMT

The timers can be changed in the HA configuration

@MP18 pre-emption is a timing mechanism that will try to restore HA after a certain amount of time.
After the timer runs out the cluster will try to fail back, if the downed interface persists the cluster will fail again this for 3 consecutive tries and then the cluster will permanently fail to the secondary device till an admin fixes the problem and manually fails back

Re: HA Link and Path Monitoring

MP18 — Fri, 15 Feb 2019 21:38:36 GMT

so when link Monitoring interface comes up then the active PA which is currently passive will take over right?

How does Passive PA which becomes active will know if Link monitor interface comes up ?

Via HA1 link?

Re: HA Link and Path Monitoring

reaper — Sat, 16 Feb 2019 07:19:35 GMT

No it will not
Pre-emption uses timers, the cluster does not fail back when a monitor returns to normal

Re: HA Link and Path Monitoring

MP18 — Sat, 16 Feb 2019 08:05:44 GMT

1>So it means when Link Monitored Interface on the Passive PA comes back up then PAssive PA has no way to know that

even through HA1 then as Prempt times is expired also right?

2>So in this case user has to do the manual failover like PA which become Active we should suspend it right?

3>how much is preemt timer? before newly Active PA stops checking with Passive PA?

Re: HA Link and Path Monitoring

MP18 — Sun, 17 Feb 2019 22:14:42 GMT

Hi Reaper,

IF you can answer the questions please?

This stuff I never know before

Best Regards

Mike

Re: HA Link and Path Monitoring

reaper — Tue, 19 Feb 2019 07:22:05 GMT

1. pre-emption does not take any monitors into account. It is designed to assume a network outage is either a very temporary issue (fail back upon timer) or a very lengthy issue (fail permanently and wait for admin)

2. if the outage has taken longer than the (hold time x pre-emption attempts), the cluster will settle with the secondary being active until an admin takes action. to manually fail it back, you shourd first ascertain the primary's root issue is solved and then shortly suspend the secondary

3. the default preempt hold time is 1 minute [1-60], but is configurable if you access the advanced timer settings

'Flaps Max' indicates how many times preempt is allowed to 'try' before permanently failing, and is 3 by default [0-16]

Re: HA Link and Path Monitoring

MP18 — Tue, 19 Feb 2019 16:35:41 GMT

MAny Thanks for replying back in detail.

Lot to learn from here