Layer-3 Active/Active mode with ARP load-sharing

[homicidedart]

Hi All

I'm just wondering, if I'm using layer-3 sub-interfaces in active/active mode, is it possible to create ARP load-sharing for each sub-interface on both PA.

by EX: sub-interface 1.102 with IP address 192.168.102.2 on PA-1 and 192.168.102.3 on PA-2  ARP IP 192.168.102.1

sub-interface 1.110 with IP address 192.168.110.2 on PA-1 and 192.168.110.3 on PA-2   ARP IP 192.168.110.1

is that possible?

Regards,

Maher

[HULK]

Hello Mehar,

ARP load sharing is only really effective with directly connected clients over L2. The basic recommendations are given below,

a. HA cluster is not deployed in a layer 3 sandwich

b. No layer 3 separation between the hosts in the LAN and HA cluster. Since the HASH of the MAC address in the ARP request is used to for load sharing, a layer3 device between the hosts and cluster will defeat this purpose, because the HA c. The cluster will only see the MAC address of the router.

If your clients are connected through those sub-interfaces within the same L-2 networks, then as per my understanding it should work. But, I never tried this  .

Thanks

[pulukas]

Yes, arp load sharing configuration is possible in Active/Active clusters.  See DOC-2541 on page 18 and following for the configuration example.  This was released for PanOS 4.  I can't find an updated version, but this should still work as designed with the newer releases.

Configuring Active/Active HA PAN-OS 4.0