HA and stateless connections...

[scantwell]

Ok, I have what may be a newbie type question, but it is one that I wanted to ask.

In the PA 201 class, they teach for HA, that stateless connections are not synched.

What is considered a stateless connection?  I do not think it would be UDP traffic (although this comes to mind), but if I am running a audio or video call to the Internet, it is going to use H323 traffic, which is RTP traffic (UDP).

If the FW fails over, I would not expect my video or audio call to drop completely or need to reestablish it.

So perhaps someone can help me better understand what this means, so I can explain it to my team.

Thanks

[mikand]

Generally speaking I think its UDP (but not all) based traffic and stuff that uses ICMP.

For example even if UDP strictly speaking is stateless the layer7 applications using UDP can still contain various states like when using VoIP, TFTP, DNS etc.

I mean a DNS reply shouldnt be the first packet between two hosts on specific ports, first there should have been a DNS request.

[scantwell]

Do we have any other information out there (maybe from tech support, engineering, etc) who can provide a more accurate answer. Much appreciated.

[mbutt]

Hi,

All the sessions in the session tables are synchronized with the exceptions of following:

In Active/Passive mode, ICMP sessions are not synchronized between peers.

In Active/Active mode, Multicast sessions are not synchronized between peers.

https://live.paloaltonetworks.com/docs/DOC-4375

Thank you

Numan