I've been looking everywhere and I can only find information on virtual wires being used for path-monitoring in HA. What I'm looking for is if when in HA, do the virtual wires fail over? If they do fail over is there a best practices document detailing how and what type of interfaces fail over? Fail over of a L3 interface makes sense since the new firewall will answer ARP requests for the failed firewall, but how does that work with virtual wires?
With Vwires the firewall behaves as physical layer device. Few things to keep in mind
- Make sure you have the Link State Pass Through confiugued on the VWire. When one of the interfaces in the vwire fails, the other one will be brought down. So essential both the upstream and downstream devices connected to the VWIRE will realize the failure
- With HA, the link state on the passive device is DOWN. So the ports on switches or routers connected to the passive device will always be down state. The links on the active device will be up
- You can either configure link monitoring on path-monitoring on the VWIRE.With link monitoring and Link State Pass Through confiugued on the VWire if one of the links fail, the other link in the vwire will also fail and the device will change state to non-functional.
As for the configuration, refer to the document at https://live.paloaltonetworks.com/docs/DOC-1160. The same procedure applies for Vwire.
I guess I'm still a little confused on how to wire this up to an HA pair. I have a VLAN for my subnet my WAN router is on. Lets say vlan 10 and my WAN router IP is 192.168.10.254 and my data center switch virtual VLAN ip address is 192.168.10.253.
Cabling is no problem since it is going straight to one PAN virtual port, and then through the PAN to the router's LAN port.
router LAN <--------------> PAN#1 virtual wire p1 ---- PAN#1 Virtual wire p2 <------------------> data center switch
But how do I wire in the second PAN to this?
If you require trunk for multiple vlans then you will need a dedicated switch between the router and the PA pair.
As the virtual wire is essentially connecting these two VLANs together, did you use crossover cables cables on one of the sides from PA to the switch? As fixing the port speed/duplex disables Auto-MDIX...
I need to do this for a similar scenario, but I have a Cisco router one side and a Cisco ASA on the other. Without the isolate VLAN the ASAs fail to form a resilient pair as with the ASA directly cabled to the PAN the standby ASA has one of its interfaces link-down so the Secondary is shown as failed.
So I will have:-
ASA <---> Isolate VLAN <---> PAN Untrust <-> PAN Trust <-x-> Data Centre VLAN <---> Router
This is so I can have the PAN in the traffic path performing web-filtering etc but use the ASA for L3 functions. I have valid reasons for this topology, testing the failover of both the ASA and PAN independantly should be interesting!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!