Hardware failure recovery in an HA pair

[jdprovine]

What is the best way to recover the primary PA 5050 if the hardware completely dies?

[Raido_Rattameister]

Well I guess that second firewall took over.

So when you get new hardware then configure mgmt interface, HA settings and from firewall that has config you sync to peer.

Also Link and Path monitoring needs to be configured on both firewalls seperately.

Are they in Panorama?

[jdprovine]

@Raido_Rattameister

Yes I would assume that the secondary would take over to, this hasn't actually happened I was thinking about the best way to deal with it. So you would let the secondary sync to the new hardware?

No panorama

[Raido_Rattameister]

Yes that is all you have to do.

But be careful. Sync to peer is available on both firewalls. If you accidentally click on it on the empty firewall then empty config is pushed to other one and your environment will go down 🙂

[jdprovine]

@Raido_Rattameister

So did you make new hardware the secondary or the primary again. Recently PA TAC told me to disable sync to peer on the secondary

[Raido_Rattameister]

If one firewall fails then you replace it, set up management, ha, path and link monitoring.

Make sure to set ha priority higher number on new firewall so it would not become active with empty config.

Log into old firewall and click sync to peer.

Done

[jdprovine]

@Raido_Rattameister

So you would bring the replaced one back on as the primary again? We only have 2 PA's and primary and a secondary. 

[Raido_Rattameister]

Let's assume you call them primary and secondary.

Primary is active.

Primary fails.

Secondary becames active.

You RMA the hardware.

Configure settings on new primary.

If it becames acitve before you have synced config from secondary then your environment goes down.

So initially you have to have HA priorithy higher number on new primary compared to secondary so it would not become active.

After sync to peer you can change priority settings so that new primary becomes active again.