Most Stable Release for PA500 Cluster

[licenselu]

Hello,

What's the most stable release for a cluster (active/passive) of PA500 running IPS, AV and URL filtering ?

Regards,

Hedi

[gswcowboy]

IMO and my opinion only, I'd say 3.1.10 and 4.0.5 respectively.

Regards,

Renato

[ggarrison]

I would concur with Renato's recommendation for 3.1.10 or 4.0.5 currently.

[jleung]

Hi,

Definitely 3.1.10 if you don't need 4.0.x new features, otherwise 4.0.5.

Regards,

Jones

[licenselu]

Hi all,

First, thanks a lot for your input.

I will move to 4.0.5 (running like a charm in my lab on standalone device) because new features set.

I have another question.

Is is required to run the same sofware version on both members of the cluster.

The idea here is avoiding installing instable software on both members.

In case of problem, I can easily come back to the old version (failover).

Regards,

Hedi

[gswcowboy]

It's required. Otherwise, one will be in non-functional state.    

[licenselu]

Hello,

First, thanks a lot your help.

Does this non-functionnal state occurs if we are upgrading in  the same MAJOR release train (example from 4.0.3 to 4.0.5) ?

After reading the Document 'Upgrading HA pair from 3.1 to 4.0' is seems that it should not occur

'Were the upgrade taking place for a maintenance release, ie 3.1.6 to 3.1.7, the newly upgraded device would go to a passive state.'

Regards,

Hedi

[gswcowboy]

Hi,

This state is continuous if the ha cluster does not have matching panos versions(3.1.x and 4.0.x) even if you try to make the passive device functional. Not the same when you're upgrading from say 4.0.3 to 4.0.5. Assuming both have the same panos after an upgrade and the passive was once non-functional, making it functional will bring it back into passive state.

-Renato