physical cabling for HA Active/Active

[branedge]

we have 2 new 5410 that I'm trying to set up for active/active. we have 2 ISPs a single physical content filter and a single core switch. I know there will be some fail point with the single core and content filter. my question is so i need to wire my 2nd palo to my 2 isp switches and then to my core I've attached a picture, hopefully this will make it clearer.

thanks

[Adrian_Jensen · Accepted solution]

Yes, each PaloAlto will need a cable to each ISP/content filter switch and to the core switch. Your drawing doesn't label it but I am assuming the top 2 devices at the incoming switches. Then the HA ports need to be cross connected between the PaloAltos. So the cabling would look like:

ISP1 -> Switch1 -> e/1 PaloAlto1

-> e/1 PaloAlto2

ISP2 -> Switch2 -> e/2 PaloAlto1

-> e/2 PaloAlto2

PaloAlto1 e/5 -> CoreSwitch

PaloAlto2 e/5 -> CoreSwitch

PaloAlto1 HA1-A -> HA1-A PaloAlto2

PaloAlto1 HA1-B -> HA1-B PaloAlto2

PaloAlto1 HA2/3 -> HA2/3 PaloAlto2

It's important to remember that in an Active-Active HA pair, the PaloAltos are not load sharing with a common configuration. Each is working with a particular active configuration and takes over the configuration running on its mate if the mate fails (i.e. PaloAlto1 runs config A, PaloAlto2 runs config B, if PaloAlto1 fails then PaloAlto2 runs A and B). In an Active-Passive configuration one unit runs the entire configuration and the other is monitoring/waiting to take over if the first fails.