topic Re: HA and Device Priority in General Topics

HA and Device Priority

scantwell — Fri, 21 Dec 2012 19:07:49 GMT

HA active device

Upon initial configuration the device with the lowest priority, value close to zero, becomes the active unit (default priority is 100). If two devices have the same priority value, the device with the lowest MAC address of the HA1 link becomes the active unit.

Can someone give me real world example of when both FWs would have same priority, and why would they be configured as such.

Thanks

Re: HA and Device Priority

mikand — Sun, 23 Dec 2012 13:43:07 GMT

A couple of reasons I can think of:

1) Misconfiguration due to lack of knowledge?

2) Misconfiguration due to lack of reading the manual?

3) Copy-paste monster (you copy the config of one device to make it equal on another and woops, forgets to change the prioritys).

Re: HA and Device Priority

bvandivier — Thu, 27 Dec 2012 19:18:26 GMT

If you are not using the "Preempt" feature in Active/Passive HA then two devices having the same priority should be of no consequence.

Re: HA and Device Priority

Sec101 — Fri, 01 Feb 2019 18:23:15 GMT

this

Re: HA and Device Priority

OtakarKlier — Fri, 01 Feb 2019 21:27:15 GMT

Hello,

I always like to set on lower than the other so I dont fall into a split brain scenario.

Regards,

Re: HA and Device Priority

Sec101 — Tue, 05 Feb 2019 16:57:11 GMT

This would only happen if it couldn't communicate with the secondary box correct? If you had device priority set differently, if you don't have preemption enabled, it's not going to make a difference--only the communication between the boxes is going to matter right? Help me understand this one, but with premption disabled, and device priority equal, as long as the boxes can communicate/interface monitor the correct interfaces, that preemption checkbox does not matter. Also, If you have preemption disabled, and priorities different, only if the boxes can't communicate between each other, your going to get a split brain. With preemption enabled, then it matters, as as soon as the lower numbered device comes back online, it's going to fail back over to that device. So, with device priority being equal, the HA1 mac comes into play. I'm thinking your saying that if they can't communicate over HA1 and lose connectivity, this could be a problem, even if heartbeat backup is enabled, as the systems can't read their MAC addresses and tell which is lower number---or maybe that flows through the heartbeat backup? Has anyone tested this with equal priorities, and loss of HA1 interface?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClE9CAK

Re: HA and Device Priority

MP18 — Tue, 05 Feb 2019 17:54:48 GMT

i have testes with same priority 100

device with lower HA1 mac becomes active

Re: HA and Device Priority

Sec101 — Tue, 05 Feb 2019 18:41:31 GMT

Yes i can confirm this as well. But what happens if HA1 goes down, you have hearbeat backups enabled, and priority is the same?

Re: HA and Device Priority

MP18 — Wed, 06 Feb 2019 01:37:01 GMT

i testesd with ha1 backup down and same priority.

i was trying to create split brain scenario.

Re: HA and Device Priority

Sec101 — Wed, 06 Feb 2019 14:51:46 GMT

what was your result?

Re: HA and Device Priority

MP18 — Fri, 08 Feb 2019 03:49:46 GMT

Both PA become active active as HA1 and HA1 backup link was down.

Re: HA and Device Priority

Sec101 — Fri, 08 Feb 2019 15:02:12 GMT

This would still happen with different prioities though as well wouldn't it?

Re: HA and Device Priority

MP18 — Fri, 08 Feb 2019 15:19:51 GMT

yes it will still happen with different priorities.

Re: HA and Device Priority

Sec101 — Fri, 08 Feb 2019 15:35:30 GMT

makes sense. so basically if you lose your ha1 or backup ha1 your stuck.

Re: HA and Device Priority

MP18 — Fri, 08 Feb 2019 17:14:55 GMT

yes that's how it is