HA Interfaces failover triggers

[ElliotM]

Hi All,

We currently have a pair of PA-5250 firewalls configured in active/passive. We have 4 port channel groups configured with the condition set to 'all'.

The question i have is we are using eth1/1 & eth1/2 as HA interfaces if one of these goes down will the firewalls failover?

Also is it possible to stop a interface from causing a failover? the global link monitoring configuration is set to 'any'

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

[PavelK]

Hello @ElliotM

If one of the interface that is configured for HA goes down, it will not cause failover event because these interfaces are not tracked, however as a best practice you should have a backup link for HA1 as well as for HA2 interfaces.

If HA1 interface goes down without HA1 backup to be configured, it might cause split brain when both Firewalls go into active state: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OPJCA2&lang=en_US%E2%80%A...

If HA2 interface goes down without HA2 backup to be configured, the state information between Firewalls will not be in sync.

Here is HA Best Practice KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS

If you want to exempt an interface from failover tracking, I would remove it from link interface monitoring.

Kind Regards

Pavel

[OtakarKlier]

Hello,

Set the setting on the interface group to ALL. This way both interfaces have to be down to trigger a failover.

Regards,

[ElliotM]

Hi,

Just to be sure you are saying the HA interfaces are not tracked via the link monitoring even if they are not the dedicated HA ports.

Also thanks for the other info, we have backup HA1 & HA2.

[PavelK]

Thank you for reply @ElliotM

Yes, this is my understanding. It is possible to set regular data plane interfaces to HA type and add it to HA Link Monitoring, however based on my tests shutting this interface down does not trigger a failover. I was testing it with PA-220 where I used interfaces 1/7 and 1/8 for HA.

Kind Regards

Pavel