Hardware failure recovery in an HA pair

Reply
Highlighted
L4 Transporter

Hardware failure recovery in an HA pair

What is the best way to recover the primary PA 5050 if the hardware completely dies?

Highlighted
L7 Applicator

Well I guess that second firewall took over.

So when you get new hardware then configure mgmt interface, HA settings and from firewall that has config you sync to peer.

Also Link and Path monitoring needs to be configured on both firewalls seperately.

 

Are they in Panorama?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

@Raido

Yes I would assume that the secondary would take over to, this hasn't actually happened I was thinking about the best way to deal with it. So you would let the secondary sync to the new hardware?

No panorama

Highlighted
L7 Applicator

Yes that is all you have to do.

But be careful. Sync to peer is available on both firewalls. If you accidentally click on it on the empty firewall then empty config is pushed to other one and your environment will go down :)

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

@Raido

So did you make new hardware the secondary or the primary again. Recently PA TAC told me to disable sync to peer on the secondary

Highlighted
L7 Applicator

If one firewall fails then you replace it, set up management, ha, path and link monitoring.

Make sure to set ha priority higher number on new firewall so it would not become active with empty config.

Log into old firewall and click sync to peer.

Done

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

@Raido

So you would bring the replaced one back on as the primary again? We only have 2 PA's and primary and a secondary. 

Highlighted
L7 Applicator

Let's assume you call them primary and secondary.

Primary is active.

Primary fails.

Secondary becames active.

You RMA the hardware.

Configure settings on new primary.

If it becames acitve before you have synced config from secondary then your environment goes down.

So initially you have to have HA priorithy higher number on new primary compared to secondary so it would not become active.

After sync to peer you can change priority settings so that new primary becomes active again.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!