VLANs for HA links

[AlbertJJ]

Hi all,

I am configuring two PA 3060 in A/A HA across datacenter. All the HA links from a PA in a DC will be connected to the core switch. Is it possible to put all HA links, i.e., HA1, HA2, HA3, HA1-backup, HA2-backup, in a single VLAN? Or does each link needs a separate VLAN?

Thanks

[P.Braat]

Hi

As far as i know all HA links are expected to be  in a sepperate ethernet segment. You can do this bij sepperate cables or bij seperate vlans for each ha type traffic. If you are stretching accros a data center, maybe it is wise to consider building the HA on L3 : L3 HA

hope this helps

[Brandon_Wertz · Accepted solution]

Especially in a A/A enviornment would you want to deploy something which isn't considered "best practice" from a vendor?

I've never tried to use all connections on a single VLAN, but I'd suspect the FW would take the config.

The concern would probably be the vulnerability in collapsing everything into a single VLAN and the amount of traffic this would be.

[BPry]

I'm going to go with @Brandon_Wertz on this one. TAC generally doesn't love touching A/A configurations in my experiance, if you through this in the lope they are likely going to point to misconfiguration if you ever contact them on any issues with HA. I imagine that the firewall would except the configuration but it's likely just better to do it 'by the books' on this one to avoid any issues popping up.

[AlbertJJ]

I could not find anything in the guides that each of these links should be in a separate VLAN.

Sure my first though was to configure separate VLANs but wanted to know whether this will work without issues. Then there is TAC support issue!

Thanks all!