topic Re: HA - Link Monitoring in General Topics

HA - Link Monitoring

asieber — Wed, 08 Jun 2011 14:00:23 GMT

Hi,

I´m testing the HA configuration of our firewalls and experience unexpected behavior.

If both HA members experience link down errors, we want the appliance with the most active links to be active.

In the "PAN-OS HA - Understanding PAN-OS HA states, timers and loops" document I found this:

"If both the active and passive devices experience multiple failures, the device with the least number of failed links or paths will function as the active device."

Unfortunately this doesn´t work in our case.

If both members have one link down, the passive appliance goes into non-functional state and the active appliance stays active.

Now the active appliance looses another link but instead of switching to the 2nd appliance it stays active and in the ha-log you can read "staying in functional state upon monitor failed with peer not available to go active"

Maybe I missed a configuration task?

kind regards,

Alex

Re: HA - Link Monitoring

gsamuels — Thu, 09 Jun 2011 00:40:12 GMT

Hello,

I have confirmed with engineering that this statement is not valid for current HA behavior, in a non functional stat we will not compare the number of failed links between the active and the passive device.

We are in the process of correcting the online document.

Thanks for the feedback.

Regards,

Gary S.

Re: HA - Link Monitoring

asieber — Thu, 09 Jun 2011 07:08:40 GMT

thx for the information,

even I´m not happy about it

I think it would be better to change the behavior than to change the documentation.

Why should a appliance with 5 links down stay active when the backup device only has one link down?

Most of your competitors keep the the appliance with the most links up.

Is it possible to file a change / enhancement request that you return to the old behavior?

kind regards,

Alex

Re: HA - Link Monitoring

sunilsadanandan — Thu, 22 Sep 2011 12:07:57 GMT

Hi,

Has there been any changes been made so that the Device with the most number of active links stay up ? I have a customer who has the same concerns.

It does make sense to keep the device with maximum number of active devices up with link monitoring is enabled.

Regards,

Sunil

Re: HA - Link Monitoring

mrajdev — Thu, 22 Sep 2011 19:26:51 GMT

Sunil/Alex,

I would request you to please contact your sales team from Paloalto networks to put in a feature request for your scenario.

Thanks