Connection of Palo-Alter HA A/P pair to pair of non stackable switch/router

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Connection of Palo-Alter HA A/P pair to pair of non stackable switch/router

L1 Bithead

We faced a problem with reliable connection of Palo-Alto firewall HA A/P pair to not stackable pair of switches/routers (i.e. Cisco 6500, Huawei NE40E ) with static routing and FHRP.

To make this connection we used one VLAN-interface + 2 L2 interfaces on the side of Palo-Alto HA A/P cluster, and SVI + HSRP(VRRP) + L2 interfaces on the switch-pair side. Physical topology is full-mesh (each firewall connected to each switch)
In normal situation two switches and firewall formed a L2-triangle, and secondary root switch blocked interface faced to firewall.

Connection worked fine, until we reboot one switch (STP primary root).
After rebooting switch, services was not interrtupted yet. Earlier mentioned port on secondary root switch transited to forwarding state, firewall learnt mac-addresses via one remaining L2-interface (i.e. Eth2), at this step network still works fine.
After STP primary root switch loaded, it became the STP-root again, L2 triangle formed, and porton the secondary root switch faced to Eth2 transited to blocked state, but firewall did not knew this and continued to forward packets via Eth2 interface by MAC-entries learnt while first switch was down. This situation caused service interruption that was addressed by manual clearing arp-table on firewall, after that firewall learned new entries via interface faced to STP primary root switch.

Is there any validated configuration example to achive reliable connection in this environment.

Some vendors has "Redundant Interface" functionality to achieve this, but we can't find any similar solutions on Palo-Alto firewalls.

We use VRRP and static routing to keep configuration simple.


actually i thought ive deleted this comment after passing through your question title again.

Good luck.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!