Active Active BGP AS Number

[Gene_Barden]

Have a Active/Active spit data center solution and question has been brought up if it is possible to use different AS numbers on each of the Palo's. My thinking is why have Active/Active, just use each Palo as a separate individual firewall at each DC. I'v never seen Active/Active Palo's having separate BGP AS numbers. It looks like it is possible since the VR config isn't synced but seems it would create an issue. Anyone else ever seen this or have an opinion? 

[reaper · Accepted solution]

it's possible since you can split routing completely but it would take out all reason to have a cluster in the first place, unless you'd have some site specific AS with an upstream shared AS somehow (so you do end up sharing the same IP subnet over different AS)

adding clustering will only increase overhead at no gain

[Gene_Barden]

Thanks, that was my thinking also, why even have the AA cluster at that point.

[reaper]

i've been thinking it over a bit, the thinking is probably that each site would act as DR for the other site and a floating IP could move to the other site if one site fails ? to provide internet connectivity?

if there's an option  to integrate OSPF that would be the better option, but if the network is super flat with no routing an AA A/P-P/A could work (although it will bring heartache and acid reflux 😜 )

[Gene_Barden]

The customer is already running BGP internally even though their current ASA is all static routes. I had thought about OSPF but we ended up deciding on BGP internally since that is what they are currently running and upstream to ISRs. The A/A setup is a single firewall at each DC which was originally supposed to be A/P. It's already given me enough heartache so I don't want to introduce any more. 🙂