wan interface configuration for HA active/passive

[travisj]

We are about to replace a single 2050 with an HA pair of 3050's.   Having some trouble figuring out how to get the switch and Pa configured so I can share the single ISP connection with both firewalls.

Current setup has interface 1/3 as L3 with the WAN ip address

I was trying to minimize the changes to make (because 2050 is insanely slow to commit) so attempted using a new vlan 111 on our core switch, set it up on two ports in access mode (untag all) and tried moving the ISP router and the palo alto wan interface into the switch on those two ports.

Am I going to need to change the wan interface on the palo alto to have a tagged sub interface on vlan 111 and move the wan IP addresses to it?   Hopefully I'm just missing something simple.

thanks,

[Raido_Rattameister]

You should create subinterfaces on palo only if it connects to switch trunk port.

If switch port is access then you don't use subinterfaces.

If you set up HA then interface mac addresses will change and Palo will send graditious arp out only to notify interface ip change but not for DNAT ip addresses so you should be ready to clear switch arp cache.

[pankaku · Accepted solution]

You have to move ISP link to switch. On switch there should be three ports and these three ports should be part of same VLAN, access ports. One port for ISP, One for active firewall and one for passive firewall that's it.

[travisj]

Pankaj,

That's what I thought, but I tried moving the existing firewall to that setup, moved isp, and PA to switch on same vlan with access ports, and they wouldn't talk.  Only had a brief downtime window last weekend to test so wasn't able to do much troubleshooting.  This next weekend is the planned implementation for new pair so I'll try again, and have time to clear arp and track down any issues.

Thanks for the help everyone.