OSPF A/P HA Config with Floating Static Routes

[oshcomp]

I am trying to understand the sample OSPF Active/Passive HA configuration outlined in Tech Note: How to Configure OSPF  https://live.paloaltonetworks.com/docs/DOC-1939 .   The problem I have is with the floating static routes defined on upstream and downstream routers intended to reduce failover times.   Floating static routes are described in steps 12 through 14 in the Tech Guide.   In my small test network I have a session delay of 4 seconds (measured by continuous pings across the network) during a failover.  I believe my delay is actually OSPF convergence time.  Failover delay is shorter.  I don't think the floating static routes are helping to reduce delay.

While OSPF is still converging I can see the static routes on the upstream router and on the downstream router.  However, they do not appear on the Palo Alto firewalls.  Until OSPF converges, only connected routes appear in the firewall routing table.  Since OSPF is momentarily unavailable and redistributed routes are gone, it seems that I would have to define static routes with a high administrative cost pointing in the appropriate directions on the Palo Alto firewall cluster as well as on the upstream and downstream routers.

I appreciate comments.

ingThanks.

[kbrazil · Accepted solution]

You should not have to add the routes to the firewall since the forwarding table is synchronized between the units in an Active/Passive cluster.  I think these will not show in the routing table, but they should show up in the forwarding table on the Passive device (show routing fib).  If the routes are not showing up there it might be good to open a support case.

Also, making sure the Passive Link State setting is "Auto" will keep the link up so that can save some time, too.  You might also try reducing some of the hold timers to see if it makes a difference, but it is usually best to keep those to default, if possible.

Cheers,

Kelly