topic Re: MAC addresses for HA interfaces in General Topics

MAC addresses for HA interfaces

Palobeacon — Wed, 09 Jun 2021 14:49:21 GMT

I have 2 virtual instances of PA-8.0 on a laptop in a home lab for learning purposes. High Availability is configured in Active/Passive mode with HA1 using the management interface and it is working but HA2 is failing to sync and complete initialization. The HA2 interface is red in the GUI and will not go green. I think this may be a problem with not having a mac address assigned. Can mac addresses be manually assigned to interfaces in the GUI? The virtualization platform is Virtualbox on a Windows 10 host.

Any assistance with suggestions, steps, videos, etc. would be welcome and appreciated.

Re: MAC addresses for HA interfaces

nikoolayy1 — Wed, 09 Jun 2021 15:31:20 GMT

First of all 8.0 is old like really old, so use 9.1. Second of all use Vmware Player/workstation or the Hyper-V on windows 10 as it is in windows 10 as Virtual Box does not support nested virtualization. For virtual mac you can check this:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-concepts/floating-ip-address-and-virtual-mac-address

Re: MAC addresses for HA interfaces

aleksandar.astardzhiev — Thu, 10 Jun 2021 18:02:02 GMT

Hi @Palobeacon ,

Like @nikoolayy1 already mentioned I would suggest to get later version than 8.0 as there are lot of changes.

But you want to stick with this version - Can you check if "Hypervisor assigned MAC address" is enabled - https://docs.paloaltonetworks.com/vm-series/8-0/vm-series-deployment/about-the-vm-series-firewall/hypervisor-assigned-mac-addresses.html

As far as I remember this setting was not enabled by default in earlier versions (like 7.0 and 7.1) and I am not sure if they enabled it by default from 8.0 or it was from 8.1.

Re: MAC addresses for HA interfaces

Palobeacon — Mon, 14 Jun 2021 14:58:19 GMT

Hi

"Hypervisor assigned MAC address" is enabled by default. I disabled it but it didn't make a difference. I configured HA Active-Active mode to use floating IP but all the HA interfaces fail to go green. Should I leave it disabled?

I will be upgrading to OS v10 later but I have to configure HA and a few other things first as I will be testing if they are still working after the upgrade.

I appreciate your assistance.

Re: MAC addresses for HA interfaces

Palobeacon — Mon, 14 Jun 2021 15:14:16 GMT

Hello

Thanks for your suggestions. I will be upgrading to OS v10 after I have configured HA. I tried the floating IP setup but couldn't get it to work. The examples basically assume you do not have any existing security rules or NAT configured that may need modification. I hope I can find a solution soon.