11-28-2018 12:41 PM
I have some questions on the Active/Standby deployment model. Right now I'm on A/A which requires all network config between the two units to be different since they're both active at the same time. From looking at the documentation, it looks like in an A/S model the network config between the two units is identical which includes all of the same IP addresses on subinterfaces, virtual routers, etc. Is this correct?
If so, does the standby simply keep its interfaces shut while not active? During a failover scenario, does the switchover happen fast enough that dynamic routing protocols to not notice and therefore not require reconvergence?
I'm aslo wondering if anyone uses their firewalls for the L3 network gateways for any of their VLANs? I was considering setting up subinterfaces and maybe using them for our DC networks so that the firewall could more directly dictate for each server what it can and not have access to without doing ACLs on a Cisco switch or router. Alternatively, I'd probably use Policy Based Routing to push the traffic from the network's gateway to the firewall.
11-28-2018 12:51 PM
Hello,
So yes to the first paragraph. And yes to keeping the interfaces in a shutdown state on the standby unit. I run A/S and dont have issues, I also run OSPF and it doesnt really mind much since the S has the sessions in it. I think last time I failed them over I maybe lost 1-2 pings. This is usually quick enough for dynamic routing since the timers are usually longer than that.
As for using the PAN as a L3 Vlan interface, I also do this since I can then segregate the traffic and get closer to a Zero Trust model. One thing I do is have one zone and carve it up into smaller subnets so that I dont run out of zones.
i.e.
zone ZeroTrust
IP subnets 192.168.0.0/24 then carve them up into /29's. Since I have a DENY ALL policy, the intra zone traffic doesnt take affect and the traffic has to be allowed between two subnets in the same zone.
Hope that makes sense.
11-28-2018 01:04 PM
I use auto not shutdown.
In this case port is active it just drops any incoming packets.
Benefit is faster failover.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcACAS
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
