Pannorama and HA Cluster

[minow]

Hey

i would like to know how the commit process works when i push commit on pannoaram to HA device group.

1) does Panorama send the configuration to both of the device and then commit it?

2) does Panorama send it only to one device and it commits it to the other device?

i have a situation of a PA HA cluster, and only one device was inserted to the Panorama and the result was that both of the device were synced but the policy was actually exists on one of the devices and on the other device there was no policy. from this i assume that panorama probably insert the serial number of the "to be deployed" PA device when it sends the policy to the device,

i would like see the white papers of this process

thank you

dor

[shasnain]

Hi,

You would have to add both the serial numbers of the HA member device in order to push the config to them from the Panorama. If you send the configuration from the Panorama to only one device , the Panorama pushed  config does not sync up between two HA pairs. You can add the two devices in one device group and pushed the configuration to them.

[minow]

What about if i have HA Cluster and i do service route for the Panorama through the untrust interface?

Panorama will see both of the device with the same IP right? so how will the configuration be pushed to both of the devices?

[ssharma]

If you use untrust interface of the device as service route, the configuration will be pushed only to active device (assuming policies are configured correctly) because only 1 ip is active at a time for active/passive, even though you have same ip on both device.  Suggested configuration would be to use management interface itself. Since management ip address are unique for both device, you will not have any issues and will prevent extra bandwidth consumption on untrust interface.

Hope this helps.

[minow]

it depands.... because panorama will also manage PA device through VPN  S2S and that will make my the connection between the panorama and the device rely on the VPN conneciton, so i cannot really move all the functionality from the device to the panorama

i would like to see that ability that Panorama will push the configuration to the active one and then the policy will be synced to the other one...

this is already done when i change for example the Interface of one PA device and push commit, the changed will also be done on the other device because most of the configuration are global to the HA Cluster, then the configuration can be done on a shared template for both of the device and specific configuration will be done on the device. (in all cases i am talking on active passive cluster)

[shasnain]

Panorama pushed config does not sync over from the Active PA to the Passive PA.