Using Panorama to setup a HA cluster

[Alex_Samad]

Hi

I am trying to setup a brand new pair of pa-5220's in active active.

But I can't set 

aux1 & aux2 for HA1, HA1 backup

IP address used for HA

and I can't seem to push the config to the PA from panorama, a cyclical error - no ip address , HA not enabled , device ID not set... 

Is it possible ?

Or do I need to setup the HA links first and then do every thing else from panorama

[acc6d0b3610eec313831f7900fdbd235 · Accepted solution]

Hi @Alex_Samad

In Panorama, you cannot set the IP addresses for HA1 and HA2.

You can indicate the interfaces that will be used for HA1 and HA2 and also select the Interfaces that will be used as HA1-Backup and HA2-Backup, and potentially HA3 (Data Ports) if you are setting up Active/Active as you mentioned.

Once you configure all the options in Panorama via template, and push it to the appliance, you then have to login locally to each appliance and override the HA1 and HA2 interfaces to configure the IP addresses for each one of them. For some reason I also have the same problem as you, where if I enable HA via template I am unable to push it to the appliance, then I also override that option locally on the box.

The reason you are receiving the error about no IP address is because, the HA1 cannot be configured without it. Differently from HA2 where the IP address is optional since it is Layer 2 by default.

I hope this helps. 

[Remo]

Hi @Alex_Samad

I tried the same thing with configuring the HA cluster in panorama. And my conclusion is: Do NOT use Panorama for HA cluster configuration. Use panorama for everything else but keep the HA settings local on the firewalls. It's simply the better solution. This way you have a clear configuration boundary without having this HA setting in panorama and this setting local ...

[Alex_Samad]

Hi

So i should use 1 template and use that for both PA's. but ignore the ha addresses.  that would be the way to go.

currently I have 2 templates and i have to duplicate things - like my GP Portal config ... thats annoying.

I might have to try that, it would also help with vlans/sub interfaces etc etc