HA path monitoring in virtual wire

[gmparis]

I've seen a couple answers here about using Path Monitoring in Virtual Wire. They say that one must use an IP address within the Virtual Wire subnet as the source address. OK, I get that. What I don't get is how to configure such an address. I don't see a way to add an address to a vwire interface. I've tried creating a loopback with no good result. Also gave vlan a shot, but that didn't look promising either. Thanks for any help.

[NGS_SOC]

They are always a little bit conservative with A/A design but I have a couple of big installation with A7A without specific issues. Also PA-3020 with PANOS 5.04 rulez in traffic response and commit time.

Regards

[gmparis]

I'm wondering why you used the manage-ip for the path monitoring instead of the NSRP IP. I have similar configurations here, both NSRP and VRRP, and my concern is that the shared address -- which is what the traffic cares about -- can be unreachable, even though the manage/local IP is reachable. This comes about because we generally have two layer-2 devices involved. This may not be your configuration, but still, I wonder if you are accomplishing what you want with this configuration.

Of course, I'm chiming in on this only because I'm getting all the updates to this thread. 🙂

[Sly_Cooper]

- Yes you may not see the issue with A/A firewall since both the firewalls will be passing traffic at a time. With Active/Passive you have to make sure that all connected devices in the path are passing traffic. Personally I am reluctant in configuring A/A model and I have never done that. A/A has its configuration complications. A careful configuration is needed. Since I was working on established A/P configuration and changing to A/A would need complete re-engineering.

- Technically I can use the NSRP ip however the issue with NSRP ip is that it becomes reachable for the failed firewall once the second firewall becomes Active. I have similar scenario as posted by where the ASA or Juniper firewall is egress/default route. The failed firewall can reach the NSRP ip via internal switch -> second PAN -> Juniper NSRP. Though this problem can be avoided by disabling Preemptive option as suggested by . I still wanted to make sure the PAN polls the correct interface for failure detection. Once the interface is UP, manage-ip too is UP. The manage-ip is available irrespective of the state of the firewall. Since Juniper provides the feature of configuring manage ip for interface,  I decided to use it. PAN is already taking care of connected devices failure detection using link monitoring (Juniper firewall trust and internal switch). I wanted to something to monitor untrust side of Juniper firewall as that is the ultimate point for traffic egress/ingress.