high availability

[S.Byrne]

hello

I have 2 x 440 series to configure for HA active/standby

I plan to use ethernet 1/5 , 6  , 7 & 8 for the Data & Control links 

I have connected the interfaces to test 

when I select interfaces under "HA Communications" only the management interface is available in dropdown -- the other ethernet interfaces are not available as an option 

Q has anyone seen this issue before ?

[Claw4609]

Hello,

Under the interface itself do you have the interface type selected as "HA"? 

[S.Byrne]

thank you -- I have enabled & the interfaces are available for selection 

I see on the dashboard the running-config is not in sync & I do not see an option for synchronising configurations 

Any idea why the firewalls will not sync running config ?

[Claw4609]

Check the firewall system logs and see if it provides a reason for why HA sync failed, what youre looking for will probably be classified as a critical severity. CLI command to sync configs is 

request high-availability sync-to-remote running-config

[S.Byrne]

thank you -- the configurations have synchronised without any input from me 

it might have been a time delay issue 

I have been testing failover -- the Active & Standby have a connection to the LAN  on eth1/4 IP  10.123.123.249 /24

I can ping this IP Address from the LAN with the Active eth 1/4 connected 

when I disconnect eth1/4 on the primary -- the Standby firewall stays in standby mode & I cannot ping until I fail the Active 

Q can I use path monitor or similar to protect against individual interface failure ?

thank you again for all your help 

I have connectivity to

[Claw4609]

The data interfaces will be in a standby state on the passive firewall and wont be active until a failover event in triggered. For example, you can set link monitoring to fail over in the event that eth 1/4 goes down, that would then put that firewall in a passive state and promote the other one to active.

This can be configured under Device > High Availability > Link and Path Monitoring. Here you'll be able to set things to your needs such as a single interface failing, maybe a group of interfaces failing. Set path monitoring, for example I can no longer ping 8.8.8.8 and 1.1.1.1, then fail over. HA Link and Path Monitoring (paloaltonetworks.com)

If you wanted to protect against a single interface failure but still keep that device as active and not fail over your could look at creating an aggregate interface. Configure an Aggregate Interface Group (paloaltonetworks.com)