About HSRP v1 support.

[smaekawa]

Hi

About HSRP v1 support.
Is PAN-OS HSRP v1 supporting?

Is support HSRP v2 and VRRP?

Thanks.

[fcellini]

Can you explain in more detail your question? Hsrp is a Cisco System proprietary protocol, what do you mean for Pan-Os support hsrp?

[UhMayYeah · Accepted solution]

HSRP and VRRP are not supported on Palo Alto Firewalls.

There  is a better option to configure High Availability which ensures stateful  redundancy between the Firewalls.

When the two firewalls are configured in High Availability Active-Passive:

•The active device continuously synchronizes its configuration and session information with the passive over two dedicated interfaces.

•In the event of a hardware or software disruption on the active firewall, the passive firewall becomes active automatically without loss of service.

Regards,

AK

[smaekawa]

sorry

I use Cisco ASR HSRP v1.

Cisco ASR connect to L2sw .

L2SW  connect to PA.

my Test configuration is following.

[Cisco ASR (HSRPv1)] ---[L2SW]---[PA]

When HSRP failover went, sometimes do not  failover HSRP.

(about 1/4)

but, if VRRP and HSRPv2 does not occur.

There is an article as follows.

https://live.paloaltonetworks.com/docs/DOC-2366

I've read above.

It is written "Cisco device is upgrade HSRP V2"

If do not work, upgrade to HSRPv2?.

I think HSRPv1 not support.

Please let me know that it supports.

Thanks.

[fcellini]

Hi, the ASR is configured in HSRP with another ASR, or with the L2SW? I don't understand. The HSRP is between two device interconnected by a PA fw?

ASR------>L2SW----->PA------>ASR ?

OR

        PA

        /    \

      L2SW

     /          \

ASR1       ASR2

Let me know.

[smaekawa]

Configration is following

ASR(HSRP:act)------ASR(HSRP:standby)

   |                      |

   |                      |

L2SW---------------------L2SW

           (Link Agg)     

    ---------------------

   |                      |

   |                      |

   |                      |

PA(act)-------------PA(standby)  

[fcellini]

So when there is the switch active to standby the pa doesn't receive the new arp from the same ip. There is a vlan configured with hsrp between ASR that connect the ip of the ASR to PA with a default route vs the PA? The PA are connected to L2SW with interface in access L3 mode, or L2 mode?

When the ASR active goes down, the secondary ASR become active, but you haven't connectivity?