Do I need to deploy a switch between 2xPA firewall (Active-Passive) and 1xJuniper MX router ?

[wsf7528]

Do I need to deploy a switch between PA firewall (AP) and a Juniper Router in order to have an aggregate ethernet interface (AE) connected? Please refer to the diagram attached.

The setup is below:

PA-1 (A)-------------PA-2 (P)

|                              |

|                              |

|          LACP           |

Juniper router

[wsf7528]

Here is the diagram.

[OtakarKlier]

Hello,

I cannot say for sure, but shouldnt have to. The Juniper will just see the connection to the passive PAN as down.

Regards,

[wsf7528]

Thanks for your reply Otakar, from PA AP, it can keep track of the ae0 link, in case the ae0 (1xchild interface only) is not response ping or down, the Active PA can trigger a failover to the passive one. 

However, I might think about if the traffic will go through ae1 link since the link is up on Passive PA and it will blackhole the traffice.

Or you think the traffic won't go through the ae1 between MX and PA-passive FW?  

[Raido_Rattameister]

Device > High Availability > General

If it is Shutdown then Juniper sees AE1 as down.

If it is set to Auto then AE1 link is up but passive Palo is not responding to ARP requests so if Juniper don't have any ARP entries pointing to AE1 it should not send any traffic towards it.

Benefit with auto is that you can have LACP pre-negotiated on passive Palo and failover takes less time.

[wsf7528]

Thanks chaps!