PA500 HA with Layer 3 OSPF connectivity to Core

Reply
L2 Linker

PA500 HA with Layer 3 OSPF connectivity to Core

Hi

 

We currently have 2 PA 500 which are currently  configured for HA. But don't think its currently setup correctly.

This is what I can find regarding as to what we want to achieve.

 

Active passive with OSPF

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000CyRYAA0&field=Attac...

 

But the above article doesn't really make sense, like on the widget display it says HA peer's IP used is 1.1.1.4  and 1.1.1.15.

 

Kind Regards

 

 

 

L7 Applicator

Re: PA500 HA with Layer 3 OSPF connectivity to Core

@Huddlebuy,

What exactly is confusing you in the document you linked to?

As for the IPs, if these units are directly connected it doesn't matter what IP you are using; the documentation should have used RFC1918 addresses in its example, but a lot of older docs used 1.0.0.0/8 addresses as it was assigned for research for the longest time and didn't actually matter. In your environment, these IPs should be something local to your environment. 

 

 

L2 Linker

Re: PA500 HA with Layer 3 OSPF connectivity to Core

Hi

 

Yeah that makes sense. Does the device priority need to be same on both devices?  disabling Preemption ?

 

Kind Regards

 

L7 Applicator

Re: PA500 HA with Layer 3 OSPF connectivity to Core

Hello,

I would not make them the same. It is there to prevent split brain. 

 

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/device-priority-an...

 

I have preemption disabled to prevent a flapping scenario. If there is a failover event, I want the standby unit to stay active until I can determine why it occured. In the older code and models, I had it enabled and it caused a flapping where they would see a failure and constantly flip back and forth and cause downtime for me. It was a weird scenario that I have only faced once however.

 

Regards,

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!