Active Active HA3 Through EVPN/VXLAN

[Gene_Barden]

Have an Active/Active deployment, single firewall at each DC with EVPN/VXLAN through Juniper cores. Can we have the HA-3 link go through the core switches? We are using daa plane interfaces for HA-2, HA-2B, and HA-3. We have the vlans  stretched across to the other data center for the HA-2 and HA-3 links and jumbo frames enabled. I need to verify if the HA-3 link can operate properly through EVPN/VXLAN or do we need a direct connection. I ask because normally for HA-2 I would just use ethernet as the trasnport but had to use IP even though the vlans are stretched.

Also, for session setup I normally use IP Modulo but PAN config guide states First Packet is recommended.

Thanks!

[laurence64 · Accepted solution]

It is supported across switches as long as the switch has jumbo frames configured, which you say you have, although I would suggest that it is not really the best scenario, first packet would minimise traffic across the HA3 link which is always preferable, and in fact is the best staring point before doing any performance tuning.

Remember Force VR sync and Qos sync as appropriate.

[Gene_Barden]

Is there a way to determine if HA-3 is actually layer 2 prior to cutover?  I assume I can look at the arp tablein the Palo and the switches.

[laurence64]

It will be a dedicated Layer2 interface so shouldn't be anything else, you would be able to check for the MAC on the switch for the interfaces though

[Gene_Barden]

Thanks! Don't know why I said arp table for layer 2..What would explain the need for HA-2 to require an IP transport with an IP address. I did one with OTV and did not require IP transport. I am not a VXLAN expert but would assume if it is true layer 2 I could use transport ethernet.