topic Re: PA 3260 and using non dedicated as HA1 interface in General Topics

PA 3260 and using non dedicated as HA1 interface

MP18 — Mon, 27 Jan 2020 21:42:57 GMT

We have 2 PA 3260 across Data Centres.

We tried to use Eth1/13 as HA1 port but under ha1 interfaces it does not show option to choose eth1/13.

IS this by design that HA1 interface to be dedicated?

for now we used management as ha1 interface.

is this good to use management interface as ha1?

Regards

Mike

Re: PA 3260 and using non dedicated as HA1 interface

Remo — Mon, 27 Jan 2020 22:35:14 GMT

Did you configure eth1/13 as HA interface prior to selecting it in the HA config?

(I normally use the mgmt port as HA1 backup port in addition to either one of the dedicated or a DP interfaces)

Re: PA 3260 and using non dedicated as HA1 interface

MP18 — Mon, 27 Jan 2020 22:44:51 GMT

Yes i config eth1/13 as HA interface.

Re: PA 3260 and using non dedicated as HA1 interface

Brandon_Wertz — Tue, 28 Jan 2020 14:52:12 GMT

@MP18 wrote:
We have 2 PA 3260 across Data Centres.
We tried to use Eth1/13 as HA1 port but under ha1 interfaces it does not show option to choose eth1/13.

IS this by design that HA1 interface to be dedicated?
for now we used management as ha1 interface.

is this good to use management interface as ha1?

Regards
Mike

Why can't you use the HA1 port even if the firewalls are across DCs? (I'm guessing you're needing a fiber connection?)

I've got a 5220 pair spreed across 2 DCs that are 800+ miles apart using HA1 in a switched environment w/o issue.

Re: PA 3260 and using non dedicated as HA1 interface

MP18 — Tue, 28 Jan 2020 15:10:10 GMT

Yes it is a fiber connection connection between our Data centres for HA!

Re: PA 3260 and using non dedicated as HA1 interface

Brandon_Wertz — Tue, 28 Jan 2020 16:10:06 GMT

@MP18 wrote:
Yes it is a fiber connection connection between our Data centres for HA!

Can you land this fiber into a switch? Then plug copper from the switch into HA1?

Re: PA 3260 and using non dedicated as HA1 interface

BPry — Tue, 28 Jan 2020 22:41:06 GMT

@MP18

The 3200 series, much like the 5200 series, will only allow ha1-a, ha1-b or management to be utilized for HA1. The 5200 series has the advantage of being able to utilize the aux-1 and aux-2 ports as HA1 interfaces.

In this type of situation, I would recommend doing exactly what @Brandon_Wertz is saying and simply running HA1 through a switch and passing it to the PA as a copper handoff; this works perfectly fine and I'd recommend it before setting HA1 to the management interface.

Re: PA 3260 and using non dedicated as HA1 interface

MP18 — Wed, 05 Feb 2020 15:42:10 GMT

We are also checking with our PA SE if this is due to hardware or software.

Will keep everyone updated once we hear from him

Re: PA 3260 and using non dedicated as HA1 interface

jerome.popieul — Thu, 15 Dec 2022 13:28:50 GMT

Hi,
I don't know if this is a new feature not available back in 2020, but we could run HA1a and HA1b direct FW to FW over fiber on a PA-3260 without issue. (using ethx.x interfaces)
Hope this could help if you want to avoid having a switch in the middle.

Regards.