HA config

[gzauner]

Did I unstand it right, that the PaloAlto firewalls doesn't need virtual and self-ip-addresses for HA?

I just watched the HA config video, but there was no part for configuring the layer 3 interfaces for HA. At the moment we use checkpoint firewalls and therefor we need at least 3 ip-addresses for each subnet:

Example: 192.168.1.1 virtual IP

192.168.1.2 firewall-1

192.168.1.3 firewall-3

All traffic is routed to the virtual IP 192.168.1.1.

How does it work on PaloAlto devices?

Thanks for helping!

Gernot

[migration · Accepted solution]

As far as I know,

during a device or link failover, the cluster renegotiates to select a new primary unit using the same criteria as the initial negotiation.

The cluster protocol assigns a virtual MAC address to all of the primary unit interfaces. The primary unit sends special ARP packets to update the switches connected to the cluster interfaces with this MAC address change. The switches update their MAC forwarding tables with MAC address change. As a result, the switches send all network traffic to the primary unit.

I suppose this, because I didn't find anywhere a specific documentation.

Anyway, you don't need three IP addressess (2 physical and 1 virtual) as you need in Check Point. You have to configure one cluster unit ONLY, with real and routable IP addresses, the second unit is transparent to you: HA1 control link will share the configuration with the second unit.

Hope this help you! 🙂

[James]

That is correct - the specific arp used is called a gratuitous arp or GARP for short

Thanks

James

[jpa]

https://live.paloaltonetworks.com/docs/DOC-1656 for deep dive on HA