topic Re: Active/Passive HA direct link between firewalls in General Topics

Active/Passive HA direct link between firewalls

Drew-Gilman — Tue, 26 Jan 2021 16:31:22 GMT

Hi All,

I use PA-220's in HA pairs often, and I've always used a straight-through cable to connect port 7 and 8 from FW1 to port 7 and 8 on FW2. I've never had ANY issues with this configuration.

I just learned that PAN says to use a crossover cable when connecting the firewalls directly to one another like I have been doing all this time with a straight through cable.

What's the benefit of using a crossover cable vs. straight through cable? To me, it just complicates the environment and adds another item to keep in inventory. In my opinion, cross over cables are becoming more and more irrelevant as more and more devices are becoming smart enough to reverse the pins automatically.

Thanks in advance.

Drew

Re: Active/Passive HA direct link between firewalls

Mick_Ball — Tue, 26 Jan 2021 16:50:02 GMT

yes as clearly stated here..

I also use straight through, most x-over cables are made on the fly and have no twists in the last couple of inches... or maybe that's just me...

Re: Active/Passive HA direct link between firewalls

Drew-Gilman — Tue, 26 Jan 2021 16:59:50 GMT

Hi MickBall,

Thanks for responding. Yes, it was clearly stated there. My question is, what's the benefit of using a cross-over cable vs. straight-through cables?

Re: Active/Passive HA direct link between firewalls

Mick_Ball — Tue, 26 Jan 2021 17:17:14 GMT

I don't believe there is a benefit... probably hysterical from back in the day before auto sense was norm.

Re: Active/Passive HA direct link between firewalls

BPry — Tue, 26 Jan 2021 21:20:23 GMT

@Drew-Gilman,

The only benefit is that you are taking auto sense out of the equation. Autosense can fail, but it's extremely rare at this point. A crossover takes that possibility out of the equation though. So the recommendation that TAC made is technically the most correct way to do it, but lets be honest we've all moved past that practice.

Re: Active/Passive HA direct link between firewalls

Drew-Gilman — Tue, 26 Jan 2021 23:07:00 GMT

Thanks, BPry. It sounds like it's not worth the trouble of keeping/maintaining track of crossover cables in inventory and on site in the event the auto sense feature fails.