PA500 HA with Layer 3 OSPF connectivity to Core

[Huddlebuy]

Hi

We currently have 2 PA 500 which are currently  configured for HA. But don't think its currently setup correctly.

This is what I can find regarding as to what we want to achieve.

Active passive with OSPF

https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka10g000000CyRYAA0&field=Attac...

But the above article doesn't really make sense, like on the widget display it says HA peer's IP used is 1.1.1.4  and 1.1.1.15.

Kind Regards

[BPry]

@Huddlebuy,

What exactly is confusing you in the document you linked to?

As for the IPs, if these units are directly connected it doesn't matter what IP you are using; the documentation should have used RFC1918 addresses in its example, but a lot of older docs used 1.0.0.0/8 addresses as it was assigned for research for the longest time and didn't actually matter. In your environment, these IPs should be something local to your environment. 

[Huddlebuy]

Hi

Yeah that makes sense. Does the device priority need to be same on both devices?  disabling Preemption ?

Kind Regards

[OtakarKlier]

Hello,

I would not make them the same. It is there to prevent split brain. 

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/high-availability/device-priority-an...

I have preemption disabled to prevent a flapping scenario. If there is a failover event, I want the standby unit to stay active until I can determine why it occured. In the older code and models, I had it enabled and it caused a flapping where they would see a failure and constantly flip back and forth and cause downtime for me. It was a weird scenario that I have only faced once however.

Regards,