High availability Links on different locations

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

High availability Links on different locations

L0 Member

Hi,

we have 2 PA1410 on two different buildings. They act in an active-passive cluster.

On each location is a switch, and the Firewall ist connected with all of its port (ha1a, ha1b, ha2, MGM, Data) to the switch.

The switches are connected though a glasfiber to each other.

Does it make sense, to buy a fiber sfp transceiver for each firewall and connect a ha1-link directly to the other firewall?

Then  the HA1 Link is connected through the HA1A Port to the switch and Backup HA1 Link is connected through a sfp Transceiver directly to the other system. 

3 REPLIES 3

Cyber Elite
Cyber Elite

If this is not ridiculously expensive, i would recommend you get a secondary ha1(backup) link.

If both ha1 links go through the same fiber, a fiber cut will cause a split brain: both firewalls will become active and claim the IP addresses (dynamic routing and gratuitous arp) which may cause even more trouble to deal with

 

if you have a physical ha1 backup link, a link failure would be less catastrophic

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L6 Presenter

@IT-Esp wrote:

Hi,

we have 2 PA1410 on two different buildings. They act in an active-passive cluster.

On each location is a switch, and the Firewall ist connected with all of its port (ha1a, ha1b, ha2, MGM, Data) to the switch.

The switches are connected though a glasfiber to each other.

Does it make sense, to buy a fiber sfp transceiver for each firewall and connect a ha1-link directly to the other firewall?

Then  the HA1 Link is connected through the HA1A Port to the switch and Backup HA1 Link is connected through a sfp Transceiver directly to the other system. 


I would say it would depend on how the 2 buildings are already connected to each other and how much do you trust that connectivity?

 

There was a time that my company's DC was split between 2 geographic location 180+ miles apart and we had a HA A/P FW split across that distance.  We used dedicated P2P fiber and we had no issues.  Only ever used HA1/HA2 and never used a backup link for HA.

 

We did use the management port as a heartbeat backup as a fail-safe.  Using this design as long as those P2P links between the DCs never went down we never had an issue with split HA across this distance.  In this design you can use copper or fiber locally as desired for your HA.  I don't really see a reason to pay for yet another fiber link from an ISP to support a HA-backup connection.


Brandon_Wertz_0-1717508610841.png

 

Cyber Elite
Cyber Elite

@IT-Esp  We have few PA across the DC running in Active Passive Mode.

We have Two Switches in Each DC running VRRP.

HA1 and HA1B has connection to local switch in each DC.

HA2 we have Single Mode connection directly between the firewalls.

 

HA2 backup also has connection to Local switch.

We have no issues with this design.

 

Regards

 

MP

Help the community: Like helpful comments and mark solutions.
  • 510 Views
  • 3 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!