PA 5540 Deployment

[Brandon_Wertz]

I recently purchased a 5540 pair and plan on deploying them in the next few months swapping out a 5250 pair.  I'm curious if anyone has worked with the 5500s yet, or even PANOS 12.1?

Any comments or feedback you might have based on what you've seen so far.

[Brandon_Wertz]

One thing that we already provided feedback to the account team the documentation isn't exactly obvious.  When we tried getting the 5540s up, we couldn't get management online.  Apparently there are "logging" interfaces and "management" interfaces.  We had initially used the SFP ports on the left of slot 7, but that didn't get management to come up.  When we moved the SFP to the right bank of ports the management interfaces came up on the 2 boxes.  

So there's a little "ism" that isn't directly obvious for anyone trying to get these new hardware types online.

[CosminM]

Hello @Brandon_Wertz 

I haven't work yet with PA-5500 series but since you have a pair and you think to replace a PA-5250 pair, I advice to look carefully on High Availability and Clustering part. The PA-5500 series have only HSCI interface and according with official documentation (datasheet) HA active-passive is not supported yet.

In PAN-OS 12.1 for PA-5500 series there is a new feature called NGFW Clustering.

[Brandon_Wertz]

@CosminM -- Yeah I noticed that.  Thanks for the heads up.  I hear there might be some good news on that front.

[Brandon_Wertz]

Another update on the new 5540s.  It looks like the firewalls do not log locally by default.  I wasn't seeing any logs being logged directly on the device.  After disabling "high speed log forwarding" I was finally able to see logs locally on the firewall.  The setting is found here:

Device --> Setup --> Management --> Logging and Reporting Settings

[R.Frazier025081]

As of End of May 12.1.7 code brings Active/Passive to the 5540 specifically.  I'm walking through the settings now.  The 5540 still used the HSCI-A/B (eth1/37/38) ports which only run at 100G/400G. So the HA1/HA2 map to HSCI-A and the HA1-backup/HA2-backup maps to HSCI-B.  There are some new VLAN configs that I'm looking for info on right now.

[Brandon_Wertz]

@R.Frazier025081  -- I was just looking at this myself.  I just upgraded my 5540 pair to 12.1.8 and noticed that both HA1 and HA2 are mapped to the same HSCI-A interface, is this intended?  This doesn't seem right.  In other hardware types HA1 & HA2 use different physical interfaces.  It doesn't make sense to have control and session data traversing the same physical interfaces.  I've assigned other "data" ports as HA, but that other dataplane port still doesn't show up as an HA2 option or even HA1/2-backup

[R.Frazier025081]

Yes. it is.  The 5500 series changed to two TRUNKS between the the HA pair.  Don't create any HA ports using other interfaces. I don't believe they will function.  The 5500 is a different hardware animal.

HSCI-A to HSCI-A  trunks  HA1, HA2

HSCI-B to HSCI-B  trunks  HA1,-backup, HA2-backup

https://docs.paloaltonetworks.com/ngfw/administration/high-availability/set-up-activepassive-ha/conf...

This link cover the ACT/PSV setup with the changes for 5500 series--like the fact that you use VLAN 2 for the config.

It also includes *ALL* of the correct settings for real production HA failover, like AUTO mode, enabling proper LACP for passive members.   Many certified consultants setup act/psv HA using the default settings which are how HA worked poorly in PanOS 1.0.  I just cleaned up my third expensive consultant setup of firewalls that would cause an outage during any attempt to failover.

[Brandon_Wertz]

I just got the same from my SE and shared this excerpt from the same link you shared.  So yes Palo intends to collapse HA1/2 into a single link (HSCI-A) with HA1/2-backup going over the same HSCI-B interface: