Connection of Palo-Alter HA A/P pair to pair of non stackable switch/router

Reply
Highlighted
L1 Bithead

Connection of Palo-Alter HA A/P pair to pair of non stackable switch/router

Hello,
We faced a problem with reliable connection of Palo-Alto firewall HA A/P pair to not stackable pair of switches/routers (i.e. Cisco 6500, Huawei NE40E ) with static routing and FHRP.

To make this connection we used one VLAN-interface + 2 L2 interfaces on the side of Palo-Alto HA A/P cluster, and SVI + HSRP(VRRP) + L2 interfaces on the switch-pair side. Physical topology is full-mesh (each firewall connected to each switch)
In normal situation two switches and firewall formed a L2-triangle, and secondary root switch blocked interface faced to firewall.

Connection worked fine, until we reboot one switch (STP primary root).
After rebooting switch, services was not interrtupted yet. Earlier mentioned port on secondary root switch transited to forwarding state, firewall learnt mac-addresses via one remaining L2-interface (i.e. Eth2), at this step network still works fine.
After STP primary root switch loaded, it became the STP-root again, L2 triangle formed, and porton the secondary root switch faced to Eth2 transited to blocked state, but firewall did not knew this and continued to forward packets via Eth2 interface by MAC-entries learnt while first switch was down. This situation caused service interruption that was addressed by manual clearing arp-table on firewall, after that firewall learned new entries via interface faced to STP primary root switch.

Is there any validated configuration example to achive reliable connection in this environment.

Some vendors has "Redundant Interface" functionality to achieve this, but we can't find any similar solutions on Palo-Alto firewalls.

We use VRRP and static routing to keep configuration simple.

Highlighted
L3 Networker

@VMAntonenko it would help if you put a draw of your current network design.

*************************************************************
PCCSA | PCNSA | PCNSE | CyberRange | PA CyberForce
*********************************
Highlighted
L1 Bithead

Hi, thank for comment.

At first did not noticed image attachement function.

PA-to-Switch.PNG

 

In case of shut C6506-2, traffic from PA forwarded to Eth1/5.421, but after switch recover traffic still forwarded to Eth1/5.421 even if Gi6/44 of C6506-1 is already in Alternate/Blocking state. 

So we have to clear ARP-entries on PA or wait for ARP entry aging.

 

Possible solution is connection on firewall to only one switch and configure "link monitor", but i think such minor issue like phisical link failure should not lead to HA Cluster failover, especially in case of high-loaded business sensitive application.

In general, failover on Palo-Alto works fine, but i.e. on PA-5060 with hundreds on thousands of TCP connections, some of which is long-term. During failover some connections is missing, and in my experience in our company failover event often noticed by related departments.

Highlighted
L3 Networker

Hi,

another solution can be, Clustering the two Cisco Switches and configure both links on both switches and each Firewall as LAG.

 

*************************************************************
PCCSA | PCNSA | PCNSE | CyberRange | PA CyberForce
*********************************
Highlighted
L1 Bithead

Yes, i always doing LAGs in such cases, but sometimes we have to deal with devices without M-LAG functionality.
Like existing C6506 pair, no way that we ever cluster them via VSS, or it may be Huawei Net Engine Routers.
I can not believe that PA firewalls was never connected to non-stacked switches, so i asked community

Highlighted
L3 Networker

actually i thought ive deleted this comment after passing through your question title again.

Good luck.

*************************************************************
PCCSA | PCNSA | PCNSE | CyberRange | PA CyberForce
*********************************
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!