Active/Passive PAs Connected To VPC Nexus 7Ks

[DamianCleveland]

This was also posted on the Cisco forum because I'm not sure yet what is the problem's root cause. So I'd appreciate insigt from the Palo experts as well. Below is the problem:

Each 7K can ping the active-pal. Active-Pal is connected to 7K A, so  Active-Pal’s mac appears on 7K A’s interface. 7K B, again, can also ping Active-Pal. Of course, Active-Pal’s mac doesn’t appear on 7K B's interface connected to Pass-Pal, but Active-Pal’s mac does appear in 7K B’s mac address table. My assumption is that 7K B is reaching Active-Pal via the VPC pair link. Here’s the trouble, while 7K B can ping Active-Pal from its .70 address, hosts in the environment that uses Nex2 as it’s first hop cannot. Hosts using 7K A reach Active-Pal without problem. If the 7K B pass-pal interface is disabled, active-pal becomes reach-able from hosts in the environment.

There is now a move planned, that would relocate the Pal's. Should the existing, inside layer 3 connections be maintained, or should said links be converted to layer 2? I understand that the answer to this question might be revealed in the outcome of the above analysis.

**********************

Not shown in the diagram is a single edge router, so there's no chance of assymetric routing there. My understanding is that the best Palo design here would be Active/Passive. True or false?

Also is the point to point layer 3 interface design the best approach? Should the nexus links be layer 2 interfaces?

Thanks for the help.

[pulukas]

Yes, PAN recommends keeping clusters Active/Passive unless there are certain circumstances that require an Active/Active design.

The point to point routed link may or may not be best depending on the nature of your routing and zone configuration but is frequently a good practice.

Your basic issue here is that VPC or AE/LAG connections on the Cisco side are connecting to what is essential a Redundant Ethernet connection on the PAN side.  So on the Cisco side you would be using the "backup" interface feature which is generally the IOS implementation of Redundant ethernet.