HA on a PA-450 using Strata Cloud Manager

[James.Woodhouse1]

I’m attempting to configure active/passive HA on a PA-450 using Strata Cloud Manager as per this guide: https://docs.paloaltonetworks.com/ngfw/administration/high-availability/set-up-activepassive-ha/conf...

I’m aware a PA-450 doesn’t have dedicated HA ports, however when using Panorama I can set Eth1/7 & Eth1/8 to HA mode as shown in the image below and it works fine:

When using Strata Cloud Manager, HA mode is not an option on interface configuration.

Using the Strata HA workflow, I’m able to set HA-1 to use the management interface, but then unable to list data interfaces as candidate for HA-2,

I’ve ensured that data interfaces are configured and set to L3 mode on each firewall in the pair.

Does anyone have any experience with this please?

[MikeFreyman-WWT · Accepted solution]

The 'Interface Type' needs to be Default to be used for HA configuration in SCM. This needs to be configured in SCM at the Configuration Scope of each HA firewall.

That is what worked for me.

[James.Woodhouse1]

Thanks Mike, I'll try that next week.
Just to confirm is the Interface type 'default' only for the interfaces intended for HA-1 & HA-2, or ALL other data interfaces as well?

[MikeFreyman-WWT]

Just the interfaces you want to use for HA.

[James.Woodhouse1]

Hi @MikeFreyman-WWT 
Thanks for the help, I finally got this working today after a bit of a journey!
(I'm attempting to use folders/snippets and variables from Day1)

Journey:

• Create 'base' snippet (interfaces, zones, router, but excluding HA) and apply to top level 'branch' configuration scope
  • Override variables on the firewall configuration scope

• Create 'HA' snippet for HA interfaces with the aim of applying on the firewall configuration scope
  • unable to set interface type to 'default' in snippet
    • delete Snippet

• Set interfaces to 'default' at the firewall configuration scope

• Create variables in 'All firewalls' configuration scope (with the aim of using on the firewall configuration scope) for:
  • $eth1-7-ip-ha
  • $eth1-7-ip-subnet-mask-ha
  • $eth1-8-ip-ha
  • $eth1-8-ip-subnet-mask-ha

• Override variable values at the firewall configuration scope

• Create HA Group, PUSH
  • Receive Error, assuming due using one variable value (IP address) and applying to both HA peers

• Delete HA group

• Verify:  'base' snippet (interfaces, zones, router) and apply to top level 'branch' configuration scope = yes )
• Verify: variable values for data interfaces applied at 'site' configuration scope = yes )
• Verify: HA interfaces [Eth1/7 & Eth1/8]  applied a 'firewall' configuration scope = yes)

• Create variables in 'All firewalls' configuration scope
  • $eth1-7-ip-ha-branch1
  • $eth1-8-ip-ha-branch1
  • $eth1-7-ip-ha-branch2
  • $eth1-8-ip-ha-branch2
  • $eth1-7_8-ip-subnet-mask-ha-branch-all

• Create HA, received error upon (again assuming) using one variable [$eth1-7_8-ip-subnet-mask-ha-branch-all] in multiple [x4] places [HA control & data interfaces]
  
  

• Delete HA group

• Delete variables in 'All firewalls' configuration scope
  • $eth1-7_8-ip-subnet-mask-ha-branch-all

• Create variables in 'All firewalls' configuration scope
  • $eth1-7-ip-subnet-mask-ha-branch1
  • $eth1-8-ip-subnet-mask-ha-branch1
  • $eth1-7-ip-subnet-mask-ha-branch2
  • $eth1-8-ip-subnet-mask-ha-branch2

• Create HA, error received again

• Convert Subnet masks to manual [255.255.255.252] e.g. not using variable), but retain variable for IPv4 address [ e.g. $eth1-7-ip-ha-branch1]

• Push, Success !