Active/Standby network design and usage as network gateway?

Reply
Highlighted
L4 Transporter

Active/Standby network design and usage as network gateway?

I have some questions on the Active/Standby deployment model.  Right now I'm on A/A which requires all network config between the two units to be different since they're both active at the same time.  From looking at the documentation, it looks like in an A/S model the network config between the two units is identical which includes all of the same IP addresses on subinterfaces, virtual routers, etc.  Is this correct?

 

If so, does the standby simply keep its interfaces shut while not active?  During a failover scenario, does the switchover happen fast enough that dynamic routing protocols to not notice and therefore not require reconvergence?

 

I'm aslo wondering if anyone uses their firewalls for the L3 network gateways for any of their VLANs?  I was considering setting up subinterfaces and maybe using them for our DC networks so that the firewall could more directly dictate for each server what it can and not have access to without doing ACLs on a Cisco switch or router.  Alternatively, I'd probably use Policy Based Routing to push the traffic from the network's gateway to the firewall.

Highlighted
Cyber Elite

Hello,

So yes to the first paragraph. And yes to keeping the interfaces in a shutdown state on the standby unit. I run A/S and dont have issues, I also run OSPF and it doesnt really mind much since the S has the sessions in it. I think last time I failed them over I maybe lost 1-2 pings. This is usually quick enough for dynamic routing since the timers are usually longer than that.

 

As for using the PAN as a L3 Vlan interface, I also do this since I can then segregate the traffic and get closer to a Zero Trust model. One thing I do is have one zone and carve it up into smaller subnets so that I dont run out of zones.

i.e. 

zone ZeroTrust

IP subnets 192.168.0.0/24 then carve them up into /29's. Since I have a DENY ALL policy, the intra zone traffic doesnt take affect and the traffic has to be allowed between two subnets in the same zone.

 

Hope that makes sense.

Highlighted
L7 Applicator

I use auto not shutdown.

In this case port is active it just drops any incoming packets.

Benefit is faster failover.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcACAS

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!