Session behaviour during vrouter changes

[Mack]

Hi everyone,

We've got a number of virtual-routers in our PA-5050s and we're looking to do some consolidation to simplify the configuration.  Basically, we're looking to reduce the number of vrouters by moving interfaces that are currently in different vrouters into one common one.  We are not going to change the zones associated with the interfaces.  I'm wondering what happens to existing/established sessions on the firewall when we move the interfaces from one vrouter to another.

My question is this: if we have an existing session through the firewall that was established based on a particular route pattern that determined the source and destination zones, then we change the route pattern but the src and dst zones remain the same, do the existing sessions continue or do they become invalid / get terminated?

Long explanation:

We have several server subnets and one core (physical) router in our network.  We put the server subnets behind our PA-5050s on their own dedicated interface a few years ago, but we wanted to give them each a dedicated 1Gb link to our core router.  So we created a vrouter for each server subnet and used a /30 routing subnet on a different dedicated interace between the core router and our PA-5050s to force each server subnet's traffic over a different link.  So for our 5 server subnets, we're using 10 interfaces (5 x core<-->PA, 5 x PA<-->servers).  While each server interfaces has its own zone, all of the /30 routing interfaces are in the same zone.

We've now established 10Gb connectivity between the core router and the PA-5050s, so we do not need the separate interfaces.  This 10Gb link is in the same zone as the /30 routing interfaces.  To simplify our configuration, we'd like to start collapsing the separate server vrouters into one common one that uses the 10Gb link as its route to the core router.  This will not change the zones, only the routing.

We need to know if we need to schedule an server outage when we change the routing.  Our hope is that since the sessions are based on the zones (which will be unchanged) and the firewall is able to do dynamic routing, the sessions would stay alive. However, the existing sessions that were previously routed across the 1Gb link will now be using the 10Gb link in a different vrouter, so maybe the firewall won't like that.

[pulukas]

My experience with vrouter changes is that they are disruptive.  They appear to delete and then recreate the affected vrouters.

I would expect all sessions to be lost and need to re-establish after this commit takes place and would plan for a session impact change window.