3 node cluster or HA

[M.Sridharan]

Hi community.

I am setting up a palo alto firewalls for  a customer and they need it as 3 nodes. they are going to be placed in three different buidling inside the same campus.

I have gone through the documents and seeing that clustering is the only option as it is 3 in number.

I want to know is there any way that i can make this into HA of 3 nodes with their HA1 and HA2 being switched using LAyer 2 extensions across these buildings.

Also if i want to form a cluster, only session synchronisation is achieved via HA4 links, won't the config and control plane activities wont be synced across the cluster members via the Group master ?

OR config sync for cluster can be achieved only via panorama deployment ?

Kindly shed some light on this to get me decide things up.

Thanks in advance

[BPry]

@M.Sridharan,

I'm confused by the business requirements here. Why do you need three firewalls simply because you have three buildings across your campus? What's the rationale there? 

[M.Sridharan]

Its the ask from the client that they need to have higher redundancy 

[BPry]

@M.Sridharan,

Unless this environment has multiple active DCs in each building, or an actual active/standby DC, this rarely actually makes sense. I don't know what type of environment you're working with here, but it's just pretty abnormal that someone with this sort of setup would be outsourcing its configuration to someone who hasn't set it up before. You'll also have limited hardware options that actually support this, so there's quite a lot of groundwork to do to verify that this actually makes sense for the client and they're prepared for the cost of what they're asking for. 

I would highly recommend reading up on clustering and the limitations that it brings, alongside asking a ton of environment questions to verify that it is the right choice. Depending on the environment, introducing it properly and actually accomplishing increased redundancy can mean introducing a lot more changes than just the firewall topology. 

As for your actual questions:

I want to know is there any way that i can make this into HA of 3 nodes with their HA1 and HA2 being switched using LAyer 2 extensions across these buildings.

This is not at all how clustering works. Toss HA1 and HA2 out of your mind in a cluster, they are only relevant if you are making a cluster out of HA pairs. 

Also if i want to form a cluster, only session synchronisation is achieved via HA4 links, won't the config and control plane activities wont be synced across the cluster members via the Group master ?

As far as configuration goes, it's assumed that you are going to be using Panorama to keep things in sync. You can do it standalone if you have templating and automation in place to mirror things, but outside of Panorama or SCM you will need to ensure that the firewalls are actually sharing the required configuration manually. 

OR config sync for cluster can be achieved only via panorama deployment ?

You do not need to use Panorama for a cluster, but it is highly recommended and would be the 'standard' way to manage things. You can absolutely do it standalone, but you're going to want to have templating and automation already in place to ensure that the configuration between cluster members are actually in-sync.

[OtakarKlier]

Hello,

Here is what I have done in the past, over 11 years ago, and never had issues.

• All connections went to two data centers and all internet traffic went out from there
• multiple buildings/Campuses
  • linked by fiber and wireless
• 3 connections each at each location
  • 1 costly fiber P2P links to a data center - Primary
  • 1 internet connection used as VPN backup to each data center -Secondary
  • 1 Wireless connection used as VPN backup to each data center - Tertiary
• OSPF and route weights to ensure traffic flowed over the proper circuits

Each location only had two PAN's in HA and never had a failure of more than one at a time. Had more issues with the circuit providers than the PAN hardware.

Regards,