High Availability with Virtual Wires?

[nugentec]

Hi,

I've been looking everywhere and I can only find information on virtual wires being used for path-monitoring in HA. What I'm looking for is if when in HA, do the virtual wires fail over? If they do fail over is there a best practices document detailing how and what type of interfaces fail over? Fail over of a L3 interface makes sense since the new firewall will answer ARP requests for the failed firewall, but how does that work with virtual wires?

Thanks,

Frank

[gsamuels]

Hello,

Yes Virtual wire pairs can be specified as a failover condition using both Link or Path monitoring.

Path monitoring is where the firewall pings a specific IP address to test for network connectivity.

Pings are sent every 200ms to the configured destination(s).

If there is no response for over 2 seconds , failover is triggered.

For virtual wire pairs you will have to specify an additional address from which the pings will be sourced with the destination addresses.

Regards.

Gary S.

[dcurrie]

Can you be more specific?  I too am holding off on setting up an HA pair because of this.   I would like to see some details on how to do this with Virtual Wire links along with having some "traditional" L3 ports in the configuration.

Example:  I have my traditional External/Internal/DMZ L3 ports setup on the PAN, but I also have two ports setup as a Virtual Wire that I send all my WAN traffic through for inbound/outbound scanning of my WAN traffic to remote offices.  How will this fail over?

Thanks

[dcurrie]

I should be more specific on my WAN Virtual Wire setup.   The Ethernet port from my Cisco WAN router is going in to one of the Virtual Wire ports on the PAN, and the second Virtual Wire port on the PAN is going to my Cisco core switch in the data center.    My rules just pass through the data, but I scan for virus/threat/apps to keep my WAN traffic "clean".    The core switch in the data center is L3 and routes all WAN traffic to the Cisco WAN router.   In the Virtual Wire mode, this is just passing through and the router and switch see no difference with the PAN "in the middle"    The Cisco core switch port that connects is a VLAN or L2 switchport.

How do you configure this in an HA pair?

Thanks

[kbrazil]

Hi there,

You can think of Virtual Wires as CAT5 cables.  The failover for Virtual Wire is very simple - it's like moving a CAT5 cable from the Primary unit to the Secondary unit.  The traffic failover is dependent on the devices on either side of the Vwire detecting the link moved over and reconverging.

As of PANOS 3.1 if one side of the Vwire goes down, the other interface tied to the Vwire will also go down by default.  This helps with failover so the surrounding devices will both see the original path is down and re-route.

Cheers,

Kelly

[jpa]

Frank

With Vwires the firewall behaves as physical layer device. Few things to keep in mind

- Make sure you have the Link State Pass Through confiugued on the VWire. When one of the interfaces in the vwire fails, the other one will be brought down. So essential both the upstream and downstream devices connected to the VWIRE will realize the failure

- With HA, the link state on the passive device is DOWN. So the ports on switches or routers connected to the passive device will always be down state. The links on the active device will be up

- You can either configure link monitoring on path-monitoring on the VWIRE.With link monitoring and Link State Pass Through confiugued on the VWire if one of the links fail, the other link in the vwire will also fail and the device will change state to non-functional.

As for the configuration, refer to the document at https://live.paloaltonetworks.com/docs/DOC-1160. The same procedure applies for Vwire.

_Jerish

[dcurrie]

I guess I'm still a little confused on how to wire this up to an HA pair.   I have a VLAN for my subnet my WAN router is on.  Lets say vlan 10 and my WAN router IP is 192.168.10.254 and my data center switch virtual VLAN ip address is 192.168.10.253. 

Cabling is no problem since it is going straight to one PAN virtual port, and then through the PAN to the router's LAN port.

router LAN <--------------> PAN#1 virtual wire p1  ---- PAN#1 Virtual wire p2  <------------------> data center switch

But how do I wire in the second PAN to this?

thanks

[blacksan]

try this:

1. Create a isolate vlan (port access) on your cisco switch
   
2. assign three ports to that vlan
   1. Plug the Router
   2. Plug PA-1 - untrust side
      
   3. Plug PA-2 - untrust side
      
3. assign two ports on your cisco switch for the main routing
   1. Plug PA-1 - trust side
   2. Plug PA-2 - trust side
4. Verify these Cisco port settings:
   1. switch port fast
   2. no cdp
   3. fix the speed if possible (1000/Full)

If you require trunk for multiple vlans then you will need a dedicated switch between the router and the PA pair.

[adevine]

As the virtual wire is essentially connecting these two VLANs together, did you use crossover cables cables on one of the sides from PA to the switch?  As fixing the port speed/duplex disables Auto-MDIX...

I need to do this for a similar scenario, but I have a Cisco router one side and a Cisco ASA on the other.  Without the isolate VLAN the ASAs fail to form a resilient pair as with the ASA directly cabled to the PAN the standby ASA has one of its interfaces link-down so the Secondary is shown as failed.

So I will have:-

ASA <---> Isolate VLAN <---> PAN Untrust <-> PAN Trust <-x-> Data Centre VLAN <---> Router

This is so I can have the PAN in the traffic path performing web-filtering etc but use the ASA for L3 functions.  I have valid reasons for this topology, testing the failover of both the ASA and PAN independantly should be interesting!

Cheers

[Sly_Cooper]

- You can use the straight cables for vWire connections. You will need cross-over for HA connections between PAN (PA-5000). I can make out that you have ASA HA pair. How many router or connections from router that you have? Check thread as well where we had similar discussion.