topic Re: PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch in General Topics

PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

sabi4evr_com — Tue, 15 Sep 2020 07:36:58 GMT

Dear Techs,

Hope you all are doing fine and safe.

Can some one give me an insight on how I can configure 'Aggregate Interface Group' so that I can maintain a high availability for Internet traffic with my core switch?

To make it more simple. The below is my current scenario. From a single cisco core switch, up-links goes to the firewall and then to the Internet.

This single core switch is now getting replaced by 2 Huawei core switches, both in active-active mode. We have tested the 1 up-link scenario to firewall and is working as expected.

To maintain the high network availability. Both up-links from Huawei core switch have to be added in the aggregate group in firewall.

I was following this doc https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-interfaces/configure-an-aggregate-interface-group but is making me bit confused.

Let’s consider I have 2 ethernet interfaces (up links from Huawei) configured on the interfaces 2 and 9. Ideally both interface configuration should be same as well. While creating an aggregate group, how we will inform palo alto that I will be using interfaces 2 and 9 as up links and these ports should be in this group?

Re: PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

SutareMayur — Tue, 15 Sep 2020 08:07:37 GMT

@sabi4evr_com,

From switch side also, you need to create port aggregation/channel of the interfaces that are going to be terminated on the firewall. So on both end devices (switch and Palo Alto), you will have port channel/aggregation of the interfaces. This is the same the way we provide uplinks between two switches through port/ether channel.

Re: PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

Abdul-Fattah — Tue, 15 Sep 2020 08:09:20 GMT

Hi,

i will consider that both Huawei switches are as Stack otherwise that will not work:

all you need to do on Firewall is to configure both these interfaces as type "aggregated ethernet" and put them in same Aggregated group, (you can give the interfaces a LACP Priority), and then enable LACP on the new Aggregated Interface with crossponding Config (AE in same zone and VR....).

Re: PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

sabi4evr_com — Tue, 15 Sep 2020 10:21:33 GMT

Dear Abdul,

Thanks for the update.

Both switches are in stack.

For my case can you please guide me through step by step for this configuration.

Currently port #1 is configured and is connected with Cisco core switch. This port interface type is L3.

Do i need to create a similar interface configuration on port 3 for the second switch? And then proceed to the 'Add Aggregate Group'?

Re: PA-Aggregate-Group-Configuration-Dual-Uplink-Core-Switch

sabi4evr_com — Tue, 15 Sep 2020 10:51:01 GMT

Dear Abdul,

Am I mentioning the below in the configuration steps correctly? This is based on my idea so far. Please correct me if I am wrong.

STAGE 1

1. create agg grp
2. assign interface name (ae1)
3. interface type - Layer 3
4. config- virtual router > default
security zone > Internal Zone
5. IPv4 - assign the static IP for this group
6. enable LACP
7. maximum interfaces? keep it 2? as only 2 interfaces will be used for this purpose?
8. Advanced - Other info > Management Profile > Select the management profile

STAGE 2

1.Configure a new interface
2. Select aggregate group - ae1
3. leave the advanced settings to the default options