HA configuring questions?

[OMatlock]

Hi folks,

A couple more questions about HA, if you please.

Hopefully my post frequency will reduce after training next week.

(Yes, configuring HA just before the training this weekend)

I will configure HA on an existing running production PA-3020 and then add a second as Passive.

• There should be no network loss or downtime associated with the HA configuration procedure, correct?
• I could configure HA, sync to Passive, etc. without configuring Link/Path monitoring until we are ready, correct?
• I am wondering if there are methods to test for flaps on Links and Paths before configuring to determine appropriate timings and avoid unintentional failovers?

Thanks again for the support!

[Raido_Rattameister]

"There should be no network loss or downtime associated with the HA configuration procedure, correct?"

It depends 🙂

If you enable HA then interface MAC address will change (calculated based on HA group ID) so if network devices have long arp cache then might affect connectivity. After HA IP and MAC is floating from active to passive in case of failover.

"I could configure HA, sync to Passive, etc. without configuring Link/Path monitoring until we are ready, correct?"

Yes

"I am wondering if there are methods to test for flaps on Links and Paths before configuring to determine appropriate timings and avoid unintentional failovers?"

You can suspend active device to make passive active and verify that you still have connectivity without Path/Link monitor.

NB! You have "Sync config to peer" option on both firewalls so config can be pushed to peer from both sides.

If you accidentally click this on new empty device you push empty config to currently active firewall and bring your network down.

[TranceforLife]

"There should be no network loss or downtime associated with the HA configuration procedure, correct?"

It depends 🙂

If you enable HA then interface MAC address will change (calculated based on HA group ID) so if network devices have long arp cache then might affect connectivity. After HA IP and MAC is floating from active to passive in case of failover.

@Raido_Rattameister do you think gratuitous arp might help with this? 

• I am wondering if there are methods to test for flaps on Links and Paths before configuring to determine appropriate timings and avoid unintentional failovers?

Tricky one. Leave all settings as default (recommended) and then adjust timers if need be.

[Raido_Rattameister]

If I remember correctly then test arp gratuitous will send update for interface IP but not for destination NAT IPs that are behind firewall but don't quote me on that 🙂

[OMatlock]

I am getting scared about the MAC address change.

Which interface MAC will change after enabling HA?

I will not be testing failover yet, just configuring HA.

After enabling HA (MAC address change), should I expect network switches connected to Active PA to update ARP automatically and connectivity if there is an interuption?  Or do I have to do something manually on the switches to clear ARP cache?

[OMatlock]

I found this.

https://live.paloaltonetworks.com/t5/Management-Articles/After-Enabling-Active-Passive-HA-the-Networ...

Pretty straight forward, likely will lose connectivity.

I am just trying to figure out for how long and how clearing ARP cache on HP 2910al will affect anything else.

All connections (but one) come from one switch.

Would clearing the cache on this one switch be good enough?

[Raido_Rattameister]

Change switch arp cache to short period or clear arp cache after HA configuration.

Ask ISP how long is their gateway (that is next hop for you) arp cache time and complain if it is over 5 minutes.

[OMatlock]

Thank you Raido.

I was wondering about the ISP.

I guess I was thinking that since the PA is not directly connected to Internet (switch in between), may not have to consider that.

But I probably should call them.

If I clear the arp cache on my switch (any switch in general), does it start to re-learn automatically?

Just wondering if there are other implications for other devices in our network after clearing arp cache.

Thanks again.  Feels good to get responses right now.  🙂

[Raido_Rattameister · Accepted solution]

If switch receives packet it will check if source MAC (device it received it from) is already in MAC table.

If not it will add and then check to what MAC it should go to.

If it does not have destination MAC in the table it will send packet out to all ports exept the one it received packet from.

When reply packet comes it marks down what port this packet came from, update MAC table and furhter traffic flows only between those ports.

So if your devices generate traffic most likely switch will update itself fast but biggest issue is with those DNAT rules where you exept traffic in from outside but don't send traffic out from those IPs.

[OMatlock]

Thanks again Raido.

I was just talking to support about it.  He suggested that I could do a dataplane reset after enabling HA on the Primary firewall and that should do G-ARPs to have connected devices/switches update their ARP and MAC tables WITHOUT the need for clearing ARP and MAC tables.

I was thinking (to avoid an unintentional failover) I could configure HA on the primary with no HA cables plugged in, restart the dataplane to get the G-ARPs sent out and updated, verify connectivity, then plug in HA cables, enable HA on second device, and do a sync.

Of course understanding that there will be network interuption until dataplane is finished restarting...

Does that all sound right?