HSCI Port

[ce1028]

Hi,

I finally received my pair of 3250s and noticed there is the HSCI port used for HA.  I didn't realize this before purchasing, so I do not have the cable.  Is there a reason why I can't just dedicate an interface for HA to use for HA2?  

In case it matters, these firewalls will be located on internet edge. 

[sellington]

Hey Ce1028,

we have our 3250's on the edge configured with one of the ethernet ports for HA2 instead of the HSCI ports and have not had issues during our failovers.

I am not sure if there are any cons to this setup that someone else can speak to, besides losing one of our available ethernet ports, but we have had no issues. 

[TomYoung · Accepted solution]

Good question!  How do you size the HA2 links?  I haven't seen any documentation on this, but I ran into this video on YouTube -> https://www.youtube.com/watch?v=4hFQypgOAGk.  Go to 1:15:47.

If my math is correct, the PA-3250 supports 63,700 connections per second which requires 122 Mbps over Ethernet.  In this table, I would populate the IP and UDP headers if used.  The Bytes per Connection is the total of the indented rows.  The Total Bits per Second = row1*row2*row7.

Connections per Second        63,700
Bytes per Connection                  238
     Session Sync Bytes                220
     Ethernet Header/FCS               18
     IP header (20)                             0
     UDP Header (8)                          0
Bits per Byte                                   8
Total Bits per Second    121,284,800

So, GE or higher is plenty, assuming the bytes per connection in the video is correct.

[OtakarKlier]

Hello,

Yeah my sales team got an earful with our purchase, but we knew ahead of time, luckily. I also asked them to just include the cable since we already paid so much for the devices. Oh well, we did the same and just used 10GB gbics for ours. I preferred the legacy rj45, but I know it wont work in every case.

Regards,

[ce1028]

@OtakarKlier @sellington @TomYoung appreciate your responses. 

For the price, they should be including the cable for sure.

Interesting video. I won't have even half the maximum session/second that the fw supports, so my assumption is just using a 1GB port should be more than adequate. I am using 1GB port on current 3050. I wouldn't want to risk running into any problems though. Decisions decisions

[TomYoung]

Exactly!  I think you should be fine.  The video guy was a PANW engineer.  The data is probably accurate.

[ce1028]

Thanks @TomYoung