03-12-2013 04:41 PM
I am looking for the setup documentation to setup HA when the devices aren't directly connected . We have a requirement to setup fail-over to recovery site reachable via IP . I have seen the doc to setup HA with the devices next to each other .
Thanks
03-12-2013 05:37 PM
This is the document you want. This will walk you through setting up both HA1 and HA2 as L3 interfaces.
03-12-2013 04:53 PM
There's really not that much difference. I have it setup right now with our passive device across town using a Metro Ethernet link. I have HA1 and HA2 on separate VLANs. You can setup HA2 as a L3 interface, but I haven't had a problem using it in L2 for nearly five years.
You just have to watch your timers and STP setup. The attached document should help there.
03-12-2013 05:16 PM
Hi,
The boxes are 2020s and there are no vlans .
03-12-2013 05:55 PM
I have that doc and used it for HA when the boxes are next to each other . What settings do i need to change to setup it when there are separate environments. As i said the boxes are 2020 . I usually setup ports 11 and 12 . 11 being the control link and 12 being the data link
03-12-2013 06:13 PM
Do you not have a link between these two locations?
03-12-2013 06:19 PM
yes we do . There is fiber based MPLS network .
03-12-2013 06:22 PM
Another thing is we want to setup an ipsec vpn b/w the two sites .
03-12-2013 06:44 PM
I am looking at the doc again and it says the control link if on separate broadcast domains you need to specify the gateway only . The two sites are on separate domains as each has a router . So the IP of the gateway is the public address of each unit . So on both the control and data link all we need to setup are the gateway ips and on the data link select IP for transport . Am I correct ?
Thanks
03-12-2013 07:27 PM
Roland,
If you have connectivity between the two sites then yes, you just need to add the gateway that the HA port will use to reach the other firewall.
03-19-2013 11:00 PM
Roland,
Did you need additional information?
03-20-2013 08:00 AM
I can't speak for Palo Alto, but I know a lot of vendors frown upon using HA across a WAN link.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
