topic Re: Active Active HA3 Through EVPN/VXLAN in General Topics

Active Active HA3 Through EVPN/VXLAN

Gene_Barden — Tue, 09 Mar 2021 13:23:35 GMT

Have an Active/Active deployment, single firewall at each DC with EVPN/VXLAN through Juniper cores. Can we have the HA-3 link go through the core switches? We are using daa plane interfaces for HA-2, HA-2B, and HA-3. We have the vlans stretched across to the other data center for the HA-2 and HA-3 links and jumbo frames enabled. I need to verify if the HA-3 link can operate properly through EVPN/VXLAN or do we need a direct connection. I ask because normally for HA-2 I would just use ethernet as the trasnport but had to use IP even though the vlans are stretched.

Also, for session setup I normally use IP Modulo but PAN config guide states First Packet is recommended.

Thanks!

Re: Active Active HA3 Through EVPN/VXLAN

laurence64 — Tue, 09 Mar 2021 13:59:22 GMT

It is supported across switches as long as the switch has jumbo frames configured, which you say you have, although I would suggest that it is not really the best scenario, first packet would minimise traffic across the HA3 link which is always preferable, and in fact is the best staring point before doing any performance tuning.

Remember Force VR sync and Qos sync as appropriate.

Re: Active Active HA3 Through EVPN/VXLAN

Gene_Barden — Tue, 09 Mar 2021 14:42:02 GMT

Is there a way to determine if HA-3 is actually layer 2 prior to cutover? I assume I can look at the arp tablein the Palo and the switches.

Re: Active Active HA3 Through EVPN/VXLAN

laurence64 — Tue, 09 Mar 2021 15:27:33 GMT

It will be a dedicated Layer2 interface so shouldn't be anything else, you would be able to check for the MAC on the switch for the interfaces though

Re: Active Active HA3 Through EVPN/VXLAN

Gene_Barden — Tue, 09 Mar 2021 16:53:59 GMT

Thanks! Don't know why I said arp table for layer 2..What would explain the need for HA-2 to require an IP transport with an IP address. I did one with OTV and did not require IP transport. I am not a VXLAN expert but would assume if it is true layer 2 I could use transport ethernet.