Im trying to find a Palo KB that talks about recommended/best practise when setting up Palo HA with LACP to a stack switch (e.g. Cisco stack).
Can anyone guide me on this ?
For some background, we are weighing the Pros and Cons for:-
option 1) to create one single lacp (eg 4 interface member) on the stack switch, but 2 interface goes to active fw and the other to the standby firewall. making a note that the switchports going to standy fw are set to be down to prevent traffic being forwarded via the standby fw.
option 2) create 2 lacp on the switch stack, where one lacp goes to active fw and another/different lacp goes to the standby fw.
Appreciate your feedback. Thanks !
Hi @adm2tech ,
I am curios how do you plan to achieve option 1? How do you plan to set interface to standby FW down and enable them in case of failover?
From personal experiance I would recommend to use second approach - two LACP to each FW member.
This will allow benefit from couple of feature that PAN provide you for faster failover:
- Keeping the physical interface on secondary device in up state while in passive mode (Configurable under HA settings)
- Enable LACP in passive mode - allow standby member to establish LACP and maintain it established even in passive mode (configurable under AE interface)
The following KB mentioned the above config as best practise - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5ZCAS (briefly at the bottom of the page)
Thanks for the feedback. Appreciate it !!
For option 1, apologies if i wasnt very clear. So the switch ports towards the standby palo will be showing as operationally down (administrively up) because the Passive Palo interfaces are down (which is configurable to behave the opposite which you already pointed out).
So in case of a fw failover, the previous passive firewall which had the down interfaces will transition the interface state to up. Thus on the switchport (2 out of 4 members of the same port channel) will transition to interface up as well.
Technically, option 1 may seem to work but it doesnt have those advantages you pointed out on option 2.
Having said that, not sure what other downside that option 1 may bring.
Hey @adm2tech ,
Transitioning from down to up state for the interface is big disadvantage, especially with LACP. First you need to wait for the physical layer consider interface connected and then wait for the LACP to negotiate.
I personally have always used auto for secondary member interface status when deploying HA and really haven't had a use case to require or to benefit from shutting down interfaces on passive member.
I cannot think of any other downside for option 1, but I don't see any benefit from it either.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!