Best practices for HA PANs and switch stack

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Best practices for HA PANs and switch stack

L4 Transporter

For this scenario, assume a simple setup. Two firewalls in HA and two switches in a stack. Also assume the firewalls are in active/passive. Consider the below setup, each firewall has one physical link to separate switch members of the stack.


In this configuration, if switch member 1 fails and firewall 1 is the active firewall, does it automatically failover to firewall 2 if there is no link/path monitoring configured? Or are we to assume that without link/path monitoring, switch 1 failing and firewall 1 would remain active firewall and traffic to the internet would fail?

I typically always use the below configuration. Each switch has a port aggregate (802.3ad) and 1 connection in that LAG connects to each member switch. This utilizes double the ports but I was under the assumption the first scenario would only work with link/path monitoring. I also typically do the design so I can withstand any firewall failing AND any switch failing at the same time.


Finally, in the bottom configuration, does anyone have recommendation as far as setting up distribution configs on the switch side? (eg. mac src / dest). Are those needed?


L6 Presenter

Hi Mack,

Firewall1 will not trigger any failover if switch1 dies. Please refer following document.

HA active peer does not fail over when ethernet cable is pulled

You have to configure link monitoring for scenario 1.


Hardik Shah

So just to confirm.. in scenario 1, if switch 1 dies and firewall 1 is active.. no traffic flows to the internet unless link monitoring is enabled, correct?

Hi Mack,

It will follow bellow sequence of event.

1. Switch 1 dies

2. Which means port connected with Firewall1 dies.

3. Firewall will ignore the event because its not configured for link monitoring.

4. No Incoming traffic on Trust interface.

7.However Untrust interface remains active, you can ping internet from Untrust.

8. But Firewall1 remains active and rest of the interface remains active.

I would suggest to configure link monitoring, its a intelligent deciwsion.


Hardik Shah

Thank you! And to 100% confirm, internal to external traffic will not flow because the secondary firewall remains in a passive state.. correct?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!