Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

HA traffic through Cisco Switch

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

HA traffic through Cisco Switch

L1 Bithead

Hi Team ,
Can we route HA traffic between two 3260 firewalls through cisco switch using L2 vlan.

 My requirement is to run firewalls in HA and devices will be in different buildings. Buildings are connected with dark fiber. As PAN dedicated HA ports are ethernet i have to use another converter or switch to make them communicate in HA ports.

 i did l2 vlan on 9500 switch but HA1 never comes up.

Can we do like this?

6 REPLIES 6

L6 Presenter

@AvinashKukkapalli wrote:

Hi Team ,
Can we route HA traffic between two 3260 firewalls through cisco switch using L2 vlan.

 My requirement is to run firewalls in HA and devices will be in different buildings. Buildings are connected with dark fiber. As PAN dedicated HA ports are ethernet i have to use another converter or switch to make them communicate in HA ports.

 i did l2 vlan on 9500 switch but HA1 never comes up.

Can we do like this?


Technically no, but you can switch the traffic...Ok, I'm done splitting hairs.

 

You 10000% can do this.  As long as both switches participate in the same layer 2 domain it should work without issue.  (This would also mean that the link the switches are connected has the access VLAN on the trunk the HA-1 ports are on)

 

Say you have FW-1 connected to SW-1 with the FW-1 HA-1 with the IP of 10.10.10.1 on an Access VLAN 10 to SW-1

 

You'd need FW-2 connected to SW-2 with the FW-2 HA-1 configured with the IP of 10.10.10.2 on Access VLAN 10 to SW-2.

 

You would do the same for HA-2

L4 Transporter

Hi

HA1 syncs configuration and heartbeats, it uses dedicated-ha1a/ha1b ports (by default)

HA2 syncs the session table, it uses a dedicated HSCI port (10gb fiber)

You want both up for proper High Availability.

 

You can assign a Dataplane port to be of type 'HA' and then you can use it instead of the dedicated HA ports (it will be available in the drop down list under HA1/HA1 backup/HA2/HA2 backup).

This can give you the option to use ethernet1/19 as type HA, used by HA1, connected over a fiber link with appropriate GBIC on both sides thus avoiding a converter.

 

Configuration wise:

Firewall-1

Control Link (HA1) IPv4: 1.1.1.1 / 255.255.255.248

Peer HA1 IP Address (in the Setup page): 1.1.1.2

Firewall-2

Control Link (HA1) IPv4: 1.1.1.2 / 255.255.255.248

Peer HA1 IP Address (in the Setup page): 1.1.1.1

 

It's a bit tricky to explain all the possible scenarios, I hope it was clear. Just remember that each FW needs to know the IP address of it's peer for HA1 to come up. Lastly, use HA1 backup as management port and put 'Backup Peer HA1 IP Address=MGMT-IP of other FW.

I changed data port type to HA but i never get that port in dropdown for HA1 , Only for HA2 i am able to select that data port..

 

So i used L2 vlan but that is not helping

Attached screen shots for referenceScreen Shot 2020-01-29 at 9.32.26 PM.pngScreen Shot 2020-01-29 at 9.32.14 PM.png


@AvinashKukkapalli wrote:

Attached screen shots for referenceScreen Shot 2020-01-29 at 9.32.26 PM.pngScreen Shot 2020-01-29 at 9.32.14 PM.png


I refer you to my posts in this thread.  https://live.paloaltonetworks.com/t5/General-Topics/PA-3260-and-using-non-dedicated-as-HA1-interface...

 

Are you trying to use a different pot for HA-1 because you need fiber?  HA-1 has to be used on the dedicated port.

I am good , i see one typo error for peer ip.

thanks for all help

  • 8445 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!