This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About ChamindaK
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About ChamindaK
04-17-2022
3Posts
0Likes
1Solution
Apr 17, 2022Last Visited
User
Activity
User
Profile
Latest posts by ChamindaK
| Subject | Views | Posted |
|---|---|---|
| 1397 | 07-13-2017 09:50 PM | |
| 1415 | 07-04-2017 08:04 PM | |
| 1448 | 06-27-2017 03:31 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 3 Likes |
User Badges
Community Statistics
| Member Since | 06-09-2015 11:11 PM |
| Date Last Visited | 04-17-2022 09:27 PM |
| Posts | 3 |
07-13-2017
09:50 PM
1) The issue we are facing (will be facing) is when failing back, there is a delay between 'unit A' coming out of tentative-hold and then routing convergence. Ie. after tentative-hold floating IPs failback, but routing takes 10 or so seconds to converge meaning a slight outage. -- This can be mitigated using smaller BGP retry connect timers and BFD. There is still a 1-2second drop but this acceptable than 10 seconds. 2) Also with Ha3 Ae interace, if we go direct cabling between peers, would an outage of 'unit B' cause 'unit A' to go to a non-forwarding state? Do we need a switch in-between to avoid the above scenario. No - heartbeat will stay up. Also from labbing found the following: - A/A fails over session owner ship to the active firewall, which means there is no HA3 traffic to the former active=primary. Thus HA3 link does not need to support the full expected throughput of the firewall transit traffic. The downside is there is L7 or IPS for the failed over sessions even when it failsback.
... View more
07-04-2017
08:04 PM
thanks! I'm in the process of labbing this, so will post once I find out exactly how this behaves. Unfortunately stuck with A/A, as the firewalls are deployed as such in vwire. We are going to implement a L3 vsys on the existing firewall deployment.
... View more
06-27-2017
03:31 AM
Hi, We are looking at deploying an A/A L3 cluster with dynamic routing (has to be A/A to satisfy requirements of the existing setup). We've pinned all the routing preferences and floating IP priorities to 'unit A'. We are new A/A so any help with the below would be much welcome: 1) The issue we are facing (will be facing) is when failing back, there is a delay between 'unit A' coming out of tentative-hold and then routing convergence. Ie. after tentative-hold floating IPs failback, but routing takes 10 or so seconds to converge meaning a slight outage. Has anyone else experienced a similar scenario? Is there a work around? 2) Also with Ha3 Ae interace, if we go direct cabling between peers, would an outage of 'unit B' cause 'unit A' to go to a non-forwarding state? Do we need a switch in-between to avoid the above scenario. thanks very much, CK
... View more
- Tags:
- ha3
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks