High Availability with Virtual Wires?

[nugentec]

Hi,

I've been looking everywhere and I can only find information on virtual wires being used for path-monitoring in HA. What I'm looking for is if when in HA, do the virtual wires fail over? If they do fail over is there a best practices document detailing how and what type of interfaces fail over? Fail over of a L3 interface makes sense since the new firewall will answer ARP requests for the failed firewall, but how does that work with virtual wires?

Thanks,

Frank

[gsamuels]

Hello,

Yes Virtual wire pairs can be specified as a failover condition using both Link or Path monitoring.

Path monitoring is where the firewall pings a specific IP address to test for network connectivity.

Pings are sent every 200ms to the configured destination(s).

If there is no response for over 2 seconds , failover is triggered.

For virtual wire pairs you will have to specify an additional address from which the pings will be sourced with the destination addresses.

Regards.

Gary S.

[dcurrie]

Can you be more specific?  I too am holding off on setting up an HA pair because of this.   I would like to see some details on how to do this with Virtual Wire links along with having some "traditional" L3 ports in the configuration.

Example:  I have my traditional External/Internal/DMZ L3 ports setup on the PAN, but I also have two ports setup as a Virtual Wire that I send all my WAN traffic through for inbound/outbound scanning of my WAN traffic to remote offices.  How will this fail over?

Thanks

[dcurrie]

I should be more specific on my WAN Virtual Wire setup.   The Ethernet port from my Cisco WAN router is going in to one of the Virtual Wire ports on the PAN, and the second Virtual Wire port on the PAN is going to my Cisco core switch in the data center.    My rules just pass through the data, but I scan for virus/threat/apps to keep my WAN traffic "clean".    The core switch in the data center is L3 and routes all WAN traffic to the Cisco WAN router.   In the Virtual Wire mode, this is just passing through and the router and switch see no difference with the PAN "in the middle"    The Cisco core switch port that connects is a VLAN or L2 switchport.

How do you configure this in an HA pair?

Thanks

[kbrazil]

Hi there,

You can think of Virtual Wires as CAT5 cables.  The failover for Virtual Wire is very simple - it's like moving a CAT5 cable from the Primary unit to the Secondary unit.  The traffic failover is dependent on the devices on either side of the Vwire detecting the link moved over and reconverging.

As of PANOS 3.1 if one side of the Vwire goes down, the other interface tied to the Vwire will also go down by default.  This helps with failover so the surrounding devices will both see the original path is down and re-route.

Cheers,

Kelly