09-04-2014 08:24 PM
For this scenario, assume a simple setup. Two firewalls in HA and two switches in a stack. Also assume the firewalls are in active/passive. Consider the below setup, each firewall has one physical link to separate switch members of the stack.
In this configuration, if switch member 1 fails and firewall 1 is the active firewall, does it automatically failover to firewall 2 if there is no link/path monitoring configured? Or are we to assume that without link/path monitoring, switch 1 failing and firewall 1 would remain active firewall and traffic to the internet would fail?
I typically always use the below configuration. Each switch has a port aggregate (802.3ad) and 1 connection in that LAG connects to each member switch. This utilizes double the ports but I was under the assumption the first scenario would only work with link/path monitoring. I also typically do the design so I can withstand any firewall failing AND any switch failing at the same time.
Finally, in the bottom configuration, does anyone have recommendation as far as setting up distribution configs on the switch side? (eg. mac src / dest). Are those needed?
09-05-2014 07:38 AM
Thanks.. though my question is in relation to distribution algorithms for the 802.3ad channel.
09-05-2014 07:41 AM
On the switch there is no Etherchannel, its an individual Ethernet Ports.
Aggregate interface exist on PANW Firewall. You can leave it to default as its outgoing traffic from firewall. It doesnt matter which switch recieves it.
09-05-2014 07:43 AM
So you're suggesting to have the aggregate on the firewall but have that aggregate connect to standard interfaces on the switch with no port-channeling configured? The switch doesn't have to be configured for an 802.3ad aggregation as well?
09-05-2014 07:50 AM
That is right Mackwage, Firwewall in aggregate, and it goes to stand alone port of Switch. And it will work just fine.
Let me know if my answer is Helpful.
09-06-2014 10:29 AM
Check out the full sample design in the Design Guide example 4.6 on page 80 and following. I think this is the scenario for your setup.
Designing Networks with Palo Alto Networks Firewalls
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!