How HA active/passive 2000 series works

[Thiago]

Hi Guys ,

I have a dubt about HA Active/passive

How it`s works ? i need to  have  a float IP ?

OR my 2 appliances need to have the same configuration ?

I see some docs , but i don`t understand how HA works.

So if somebody can help me I`m using 4.1.3 PAN-OS.

Best Regards.

Thiago Lima.

[jseals · Accepted solution]

Hello,

Active Passive won't be using a floating IP. The devices share their configs and that includes interface IP addresses. The passive member always takes down all of it's interfaces as to not cause issues with duplicate IPs on the network.

Typically, just configure the active device as you'd like, configure the HA settings for both members and enable config sync. Once you commit they should be paired just fine.

If you'd like more information on how to configure the HA portion, let us know.

Thanks,

Jason Seals

[Thiago]

Hello Jason ,

So about Mac adresses , the devices shares yours mac address or not ?

Best Regards.

Thiago Lima.

[jseals]

Hi,

In Active / Passive HA, the members use the same virtual MACs on the dataplane interfaces which are derived from the HA group ID setting in the HA configuration.

Note that the MAC addresses of the HA1 interfaces, which are on the control plane and synchronize the configuration of the devices, are unique. The MAC addresses of the HA2 interfaces, which are on the data plane and synchronize the active sessions, mirror each other.

Thanks,

Jason Seals

[Thiago]

So ,

When i`m configuring HA Active/Passive , i need to set the same group ID to my 2 devices right ?

Best Regards.

Thiago Lima.

[jseals]

Yes,

The same group ID for both devices. This is important.

Also, if you ever have more than one HA pair on the same network be sure that each pair has their own group ID.

If two HA pairs are on the network, and all 4 members have the same group ID, this will for sure cause issues due to the mac address assignment.

Thanks,

Jason Seals

[mikand]

Speaking of which... is it possible to have active / passive / passive / passive setup (regarding your example of 4 boxes with the same groupid) ?

I cant figure out of any good example for one would like to have such setup but still :smileysilly:

[jseals]

Hi Mikand,

I can't think of a reason you'd want to do that either, and I don't believe this would be possible.

When configuring the HA links in L3, there is only an option for 1 peer IP address. Therefore, the standard 1 active machine and 1 passive machine seems to be it.

Thanks,

Jason Seals

[Thiago]

Mikand ,

I think it`s impossible to configure HA with 4 devices.

First of all , you can configure just 1 peer device.

And second on 2000 PAN serie ,  you can configure just 2 HA port per each device.

First port manage plane to syncronize confs , etc.

Second port to do stateful.

Best Regards.

Thiago Lima.

[Thiago]

Hi Guys ,

I`m configuring HA , but when i shutdown my first device , i did one test using ping , and i lost 3 packest with 64 TTL

It`s normally , or it`s possible to configure something to make this more fast ?

Best Regards.

Thiago lima.

[jseals]

Hello,

That's about normal. Also, I've seen that sometimes the pings actually do reply, but due to the failover it takes longer than normal to respond, so the ping application considers it a timeout.

You could verify this with pcaps taken on the firewalls. This may be your case, or it may just be taking that long to transfer the sessions over.

Regardless, what you're seeing is normal.

Thanks,

Jason Seals

[christopher_d_groshong]

Jason,

Thanks for comments,  if those two paragraphs were in the admin guide it would have saved me about 2 hours today

[ncampagna]

Christopher,

Which piece of information did Jason provide that you would like to see in the admin guide?  I'd like to see about adding that into the guide.

Thanks,

Nick Campagna

Product Management