topic Re: How do you deal with Service Route and MGT port redundancy? in General Topics

How do you deal with Service Route and MGT port redundancy?

Maxstr — Thu, 08 Aug 2019 15:58:40 GMT

We had an outage that took out a switch, and the PA management port is connected to that switch. I was unable to access the UI or CLI, and VPN was unable to authenticate via LDAP. I found the issue was that all the Service Routes were set to default using the MGT port.

After looking through the settings, I see that I can assign a Management Profile to multiple interfaces, which would allow me to access the UI/CLI if the management port goes down. But that does not include Service Routes, which can only be assigned to a single interface- either the MGT port, or a another interface.

Is it possible to make service routes redundant? Maybe something like a PBF rule for service routes?

Re: How do you deal with Service Route and MGT port redundancy?

OtakarKlier — Thu, 08 Aug 2019 19:51:08 GMT

Hello,

You have it correct for the managment interface. As for the service route, there is not one. Depeding on where the failure is, a HA pair might work.

But it depends.

Regards,

Re: How do you deal with Service Route and MGT port redundancy?

aleksandar.astardzhiev — Fri, 09 Aug 2019 07:30:37 GMT

Hi @Maxstr,

Unfortunately that is correct, service routes can be configured only through one interface.

However a workaround would be to configure service route based on destination. Take for example LDAP:

- You must leave the service route for LDAP on default

- On tab destinations configure two or more LDAP servers. Each server can be assignd with different interface

The catch here is that firewall will use the IP from the interface as source address when trying to connect to LDAP, BUT it will always perform route lookup first to check how to get to the LDAP server.

Re: How do you deal with Service Route and MGT port redundancy?

TSilverline — Mon, 12 Aug 2019 17:52:24 GMT

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.

Re: How do you deal with Service Route and MGT port redundancy?

jeremy.larsen — Wed, 14 Aug 2019 13:29:56 GMT

To add to TSilverLine -

Aggregate ethernet going to two different switches (stacked, MC-LAG, etc)... 😃