About Gene_Barden

Gene_Barden · ‎01-22-2021

Is it best practice to override template variable settings at the template-stack or at the device level? It looks like template stack would be sufficient unless you have multiple firewalls and only a select number with different settings.

Gene_Barden · ‎01-19-2021

The customer is already running BGP internally even though their current ASA is all static routes. I had thought about OSPF but we ended up deciding on BGP internally since that is what they are currently running and upstream to ISRs. The A/A setup is a single firewall at each DC which was originally supposed to be A/P. It's already given me enough heartache so I don't want to introduce any more. 🙂

Gene_Barden · ‎01-18-2021

Thanks, that was my thinking also, why even have the AA cluster at that point.

Gene_Barden · ‎01-18-2021

Have a Active/Active spit data center solution and question has been brought up if it is possible to use different AS numbers on each of the Palo's. My thinking is why have Active/Active, just use each Palo as a separate individual firewall at each DC. I'v never seen Active/Active Palo's having separate BGP AS numbers. It looks like it is possible since the VR config isn't synced but seems it would create an issue. Anyone else ever seen this or have an opinion?

Gene_Barden · ‎11-19-2020

Hey Guys, I have a deployment that will be a split data center, one firewall in each. Layer 2 is stretched across each DC using EVPN at the Core. The plan was to use route-based redundancy using eBGP peering to an individual ASR in each DC which will then peer to the ISP, no multi-homing. The ASRs will run iBGP between them. The customer has a /19 so we will advertise a /20 at each DC and the /19. The high end of the /20 will be advertised out DC-1 and the low end announced out DC-2. The Palo's will receive the default 0.0.0.0/0 from the ASR's. There are 2 Cores at each DC that are individual, no MLAG or VSS. Since the Cores are already running eBGP between them (EVPN utilizing ECMP running virtual gateway) we planned to peer with the core switches with eBGP running a /30 on each link to the cores and advertise the default route to the cores. Now to complicate things even more they have about 40 DMZs where the current ASA is the default gateway, not at the layer 3 device. My questions are. 1. Should I use Failover IP on the Palo's on the south side to the cores and dynamic routing at the north side to the INET edge or just keep dynamic routing all over? 2. How will the static destination and bi-directional NATs work? (The documentation I have ready says to configure device-specific NAT rules when the two HA peers have unique NAT IP address pools.) As stated one DC will have the high end of the /20 and the other the low end and both will have the /19. Or can I bind the static NATs to both firewalls? If I can bind to both firewalls, I assume routing will control which path the traffic takes. 3. The DMZs, it looks like my only option here is ARP load sharing correct for the DMZ which would mean all that traffic comes in and out one firewall which complicates things depending on the NAT. 4. Can I mix the 3 different A/A types. Route-Based, ARP load sharing, Floating IP. I wouldn't think this would be a good idea though. 5. If I have to use ARP load sharing south to the Core, how can I determine the traffic for the NATs will hit the correct firewall for incoming or outgoing or will it matter?

Member Since	‎06-06-2018 08:55 AM
Date Last Visited	‎03-22-2022 03:35 PM
Posts	47

Online Status	Offline
Date Last Visited	‎03-22-2022 03:35 PM

About Gene_Barden

GlobalProtect Pre-Logon Prompting for User Certificate

Prisma Access GlobalProtect Pre-Logon

Re: Active Active HA3 Through EVPN/VXLAN

Re: Active Active HA3 Through EVPN/VXLAN

Active Active HA3 Through EVPN/VXLAN

Re: Expedition Stuck at Phase 9 of 10

Panorama Template/Template-Stack Variables Override

Re: Active Active BGP AS Number

Re: Active Active BGP AS Number

Active Active BGP AS Number

Active-Active Route Based NAT