PA Active/Passive and Cisco stacking LACP

[K.Mohamed]

hello,

we have setup Active/ Passive connected with cisco stacking 9500 with four links full-mesh as shown below:

Paloalto active:

PA(active)  AE1 ========= cisco-1 switch (Etherchanel 10)

PA(active)  AE1 ========= cisco-2 switch (Etherchanel 20)

Paloalto Passive:

PA(passive)  AE1 ========= cisco-1 switch (Etherchanel 10)

PA(passive)  AE1 ========= cisco-2 switch (Etherchanel 20)

=================================================

Is the connection and configuration is correct or i should create 2 channels from Paloalto side like this example?

[PavelK · Accepted solution]

Hello @K.Mohamed

to me this configuration does not look ideal.

You are having 2 ports on PA side in a single port channel group and on Cisco side each port is in different port channel group. With this configuration you might have an issue with Cisco's EtherChannel guard kicking in to take ports into error disabled state.

Personally I would configure port channel 10 to Active Firewall and port channel 20 to Passive Firewall.

Paloalto active:

PA(active) AE1 ========= cisco-1 switch (Etherchanel 10)

PA(active) AE1 ========= cisco-2 switch (Etherchanel 10)

Paloalto Passive:

PA(passive) AE1 ========= cisco-1 switch (Etherchanel 20)

PA(passive) AE1 ========= cisco-2 switch (Etherchanel 20)

Also, passive Firewall will have data plane interfaces down, so there will not be any passing traffic of this port channel until there is failover event.

Kind Regards

Pavel

[K.Mohamed]

Great,

For LACP should be active or Passive ?on cisco and PA,,,

Thank you,

[PavelK]

Hello @K.Mohamed

thank you for reply.

I would configure LACP active on PA as well as Cisco side. I would also recommend to enable the LACP pre-negotiation LACP and LLDP Pre-Negotiation for Active/Passive HA  by selecting check box under: LACP > High Availability Options > Enable in HA Passive State.

Kind Regards

Pavel

[anon4all]

your configuration is incorrect. LACP port-channels (EtherChannel's) use unique ID's or port-channel numbers tied to a unique partner device (a firewall in your case)

so on the cisco side, you need to configure

interface Po10

description - palo firewall1a

!

interface 1/0/1 ! first cisco switch in the stack

description - palo firewall1a LACP link 1 of 2

channel-group 10 mode active ! says run LACP, not PAGP and make the LACP port "Active" or send LACP bpdu's proactively

!

interface 2/0/1 ! second cisco switch in the stack

description - palo firewall1a  LACP link 2 of 2

channel-group 10 mode active ! says run LACP, not PAGP and make the LACP port "Active" or send LACP bpdu's proactively

interface Po20

description - palo firewall1b

!

interface 1/0/2 ! first cisco switch in the stack

description - palo firewall1b LACP link 1 of 2

channel-group 20 mode active ! says run LACP, not PAGP and make the LACP port "Active" or send LACP bpdu's proactively

!

interface 2/0/2 ! second cisco switch in the stack

description - palo firewall1b  LACP link 2 of 2

channel-group 20 mode active ! says run LACP, not PAGP and make the LACP port "Active" or send LACP bpdu's proactively

Notice the firewall pair is called " firewall1 ", no A or B. and the two firewalls in the pair are called "A" and "B". this implies you have one virtual firewall and two members.

Next on the firewalls, you need to connect 2 cables from firewall1a to ports x/0/1. and then 2 cables from firewall1b to ports x/0/2. Notice the difference between ports 1 & 2. On each firewall, those two ports / cables get configured into the same LACP group for each cable bundle of 2.

firewall1a, ports e1/1 and e1/2 => go into PO10

firewall1b, ports e1/1 and e1/2 => go into PO20