HA A/A or A/P

[Tician]

Hello All,

I have such situation where considering in which mode to put HA PA configuration. As you can see on drawing, customer consider to put PAN in sandwich of VRRP cluster and vLAG virtual switch. VRRP has one virtual IP and MAC, and all destined packets from host went trough both active links. So far I don't know hashing algorithm of switch forwarding, but certainly both paths were used for packets forwarding.   From perspective of active and redundant paths between them, only configuration which is considered is A/A in Virtual Wire mode so far. Is this only way to put them in sandwich or somehow A/P will be acceptable?

This is under concerns for future additional configuration, where ex. we need to configure L2 interfaces to inspect something on that level...

[pulukas]

You cannot use Active/Passive in this scenario as the passive device links will not pass traffic.  So you are correct that Active/Active is your only option.

In general I create very specific rules without inspection profiles for the communication between two routers that go through the Palo Alto devices.  This insures that the vrrp, bgp or other protocol communication directly between two network devices is never accidentally touched by inspection.

[Tician]

Yes, seem that can't avoid A/A configuration in this scenario. However, you mentioned communication policies between two routers and corresponding sec policies, in that way I'm curious about L2 traffic ex. CDP traffic between two switches. How can we see that traffic on Vwire mode, if we insert PAN in Vwire mode?

Thanks!

[pulukas]

For the policies, think of the v-wire setup in the PA as a cable between the two other network devices, in your case the router and the switch.  If the packet would appear on the cable then the PA will see the packet on the interface facing the forwarding device.  Thus a security policy is needed to permit that packet to be forwarding out the opposite v-wire port the other network device.

You will see all the broadcast and general network traffic coming from the connected ports.

If you are not sure what is there you can simply add an allow all type of security policy for both directions and include logging.  Then all the traffic will be shown in the monitor traffic logs area for your review.