HA on a PA-450 using Strata Cloud Manager

[James.Woodhouse1]

I’m attempting to configure active/passive HA on a PA-450 using Strata Cloud Manager as per this guide: https://docs.paloaltonetworks.com/ngfw/administration/high-availability/set-up-activepassive-ha/conf...

I’m aware a PA-450 doesn’t have dedicated HA ports, however when using Panorama I can set Eth1/7 & Eth1/8 to HA mode as shown in the image below and it works fine:

When using Strata Cloud Manager, HA mode is not an option on interface configuration.

Using the Strata HA workflow, I’m able to set HA-1 to use the management interface, but then unable to list data interfaces as candidate for HA-2,

I’ve ensured that data interfaces are configured and set to L3 mode on each firewall in the pair.

Does anyone have any experience with this please?

[MikeFreyman-WWT · Accepted solution]

The 'Interface Type' needs to be Default to be used for HA configuration in SCM. This needs to be configured in SCM at the Configuration Scope of each HA firewall.

That is what worked for me.

[James.Woodhouse1]

Thanks Mike, I'll try that next week.
Just to confirm is the Interface type 'default' only for the interfaces intended for HA-1 & HA-2, or ALL other data interfaces as well?

[MikeFreyman-WWT]

Just the interfaces you want to use for HA.

[James.Woodhouse1]

Hi @MikeFreyman-WWT 
Thanks for the help, I finally got this working today after a bit of a journey!
(I'm attempting to use folders/snippets and variables from Day1)

Journey:

• Create 'base' snippet (interfaces, zones, router, but excluding HA) and apply to top level 'branch' configuration scope
  • Override variables on the firewall configuration scope

• Create 'HA' snippet for HA interfaces with the aim of applying on the firewall configuration scope
  • unable to set interface type to 'default' in snippet
    • delete Snippet

• Set interfaces to 'default' at the firewall configuration scope

• Create variables in 'All firewalls' configuration scope (with the aim of using on the firewall configuration scope) for:
  • $eth1-7-ip-ha
  • $eth1-7-ip-subnet-mask-ha
  • $eth1-8-ip-ha
  • $eth1-8-ip-subnet-mask-ha

• Override variable values at the firewall configuration scope

• Create HA Group, PUSH
  • Receive Error, assuming due using one variable value (IP address) and applying to both HA peers

• Delete HA group

• Verify:  'base' snippet (interfaces, zones, router) and apply to top level 'branch' configuration scope = yes )
• Verify: variable values for data interfaces applied at 'site' configuration scope = yes )
• Verify: HA interfaces [Eth1/7 & Eth1/8]  applied a 'firewall' configuration scope = yes)

• Create variables in 'All firewalls' configuration scope
  • $eth1-7-ip-ha-branch1
  • $eth1-8-ip-ha-branch1
  • $eth1-7-ip-ha-branch2
  • $eth1-8-ip-ha-branch2
  • $eth1-7_8-ip-subnet-mask-ha-branch-all

• Create HA, received error upon (again assuming) using one variable [$eth1-7_8-ip-subnet-mask-ha-branch-all] in multiple [x4] places [HA control & data interfaces]
  
  

• Delete HA group

• Delete variables in 'All firewalls' configuration scope
  • $eth1-7_8-ip-subnet-mask-ha-branch-all

• Create variables in 'All firewalls' configuration scope
  • $eth1-7-ip-subnet-mask-ha-branch1
  • $eth1-8-ip-subnet-mask-ha-branch1
  • $eth1-7-ip-subnet-mask-ha-branch2
  • $eth1-8-ip-subnet-mask-ha-branch2

• Create HA, error received again

• Convert Subnet masks to manual [255.255.255.252] e.g. not using variable), but retain variable for IPv4 address [ e.g. $eth1-7-ip-ha-branch1]

• Push, Success !

[S.Cantwell]

I am writing a reply to this, because I REALLY tried to follow along with the steps, but could not understand.

I needed to open a TAC case to get this simple configuration done.  (Argh, if only tech documentation could be written much clearer. :P)

So, in basic terms, create your folder structure as you would for NGFW FWs.

For me, I ignore putting anything in the highest (parent) folder of All Firewalls.

I created a folder (LIB Firewalls) in SCM, and put 2 FWs in that folder (FW-A and FW-B)

I created my variable and interfaces in the parent LIB Firewalls folder. (not shown here)

But real clarification is to go to the actual FW-DEVICE (FW-A and FW-B).

This is my "before" picture  (I want to have eth1/3 and eth1/4 used for HA) 

Notice that eth 3 and eth 4 show as Not Configured.

I clicked on ethernet1/3

When you add your interfaces (which will be only for HA in my example ), you are presented with the ADD Ethernet window,

(Viola!) this is where you see the mysterious Interface Type with a radio button of Default. 

You do not need to do anything anything, just hit OK, and the interface is now created (in the device folder itself). 

Do this for your 2nd interface...and......

(This is my "after".  Notice that now eth 3 and eth 4 currently show Auto (for Link Status)

Now you can come back to Configuration Scope for the parent folder (LIB Firewalls) and finish your configuration for HA with variables or IPs or whatever you need.

Thanks to Rae A (at TAC), who was wonderful and helped me in about 3 minutes.  😛