OSPF in a Active/Passive Firewall setup

vvadia — Wed, 05 Jun 2019 13:53:30 GMT

Hi,

I have a lab with a active/passive Palo Alto firewall setup. I have had a look at the Palo Guide for setting up OSPF at:

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000D8HwAAK&field=Attachment_1__Body__s

From this, it looks like it is not possible to form an OSPF neighbour with a standby firewall. The situation I am looking to avoid is waiting for OSPF neighborships to form to the standby firewall in the event the primary firewall fails. The document mentions the only workaround is to use floating static routes to carry the traffic until OSPF is established and routes learned at which point the dynamic routes will be preferred.

I am trying to find a solution where I don't need to use floating static routes and there is no downtime from going to a standby firewall from active when using OSPF.

Re: OSPF in a Active/Passive Firewall setup

BPry — Wed, 05 Jun 2019 15:22:40 GMT

@vvadia ,

The solution is the workaround mentioned in the article with floating statics to carry before the OSPF relationship establishes and passes the routes, that's the only way around it.

Re: OSPF in a Active/Passive Firewall setup

9t89m8fu — Fri, 14 Jun 2019 11:24:26 GMT

That article is outdated. Current versions of PANOS support Graceful Restart for OSPF.

topic OSPF in a Active/Passive Firewall setup in General Topics

OSPF in a Active/Passive Firewall setup

Re: OSPF in a Active/Passive Firewall setup

Re: OSPF in a Active/Passive Firewall setup