High Availability. Palo Alto Supports Two types of High Availability. I. Active/Passive II. Active/Active

Transcription

1 Agenda 1. Prerequisites for Active/Passive HA 2. What Doesn t Sync in Active/Passive? 3. Configure Interface E1/4 & E1/5 type HA respectively on Primary PA 4. Configure Primary PA with HA General Setup, Active/Passive Settings, Election Settings, Control link & Data link 5. View Primary PA HA on Dashboard 6. Configure PA2 IP address to MGMT interface & get GUI 7. Configure Time Zone, Date according to PA1 & Unique Hostname 8. Configure Interface E1/4 & E1/5 type HA respectively on Secondary PA2 9. Configure Secondary PA2 with HA General Setup, Active/Passive Settings, Election Settings, Control link & Data link 10. View Secondary PA2 HA on Dashboard 11. Synchronize configuration between PA1 to PA2 12. State for Synchronization of PA1 & PA2

2 High Availability Palo Alto Supports Two types of High Availability I. Active/Passive II. Active/Active

3 Different types of interfaces that does High Availability i. Control Link ii. Data Link iii. Backup Links iv. Path Monitoring Links i. Control Link > HA1 Interface which is used to share Heart beat between two firewalls, Synchronize configuration, User ID, IPsec information ii. Data Link > HA2 interface used to synchronize sessions, arp tables, routing tables, and session related information. iii. Backup Link > used for HA1 Backup & HA2 backup As shown above if one switch goes down than we have backup link to take over the functionality, this done to eliminate single point of failure.

4 Destination Port Protocol Description TCP TCP Used for the HA1 control link for clear text communication between the HA peer firewalls. The HA1 link is a Layer 3 link and requires an IP address. 28 TCP Used for the HA1 control link for encrypted communication (SSH over TCP) between the HA peer firewalls TCP Listening port for HA1 backup links TCP Used for heartbeat backups. Palo Alto Networks recommends enabling heartbeat backup on the MGT interface if you use an in-band port for the HA1 or the HA1 backup links IP UDP Used for the HA2 link to synchronize sessions, forwarding tables, IPSec security associations and ARP tables between firewalls in an HA pair. Data flow on the HA2 link is always unidirectional. It flows from the active device (Active/Passive) or active-primary (Active/Active).

5 Destination Port Protocol Description If HA2 link between two Firewalls are connected directly than it uses Ethernet protocol (0x7621) If its indirectly connected or synchronization has to happen through any routing device than it uses IP protocol 99 or UDP port 29281

6 Prerequisites for Active/Passive HA To set up high availability on your Palo Alto Networks firewalls, you need a pair of firewalls that meet the following requirements: The same model Both the firewalls in the pair must be of the same hardware model or virtual machine model. The same PAN-OS version Both the firewalls should be running the same PAN-OS version and must each be up-to-date on the application, URL, and threat databases. They must also both have the same multiple virtual systems capability (single or multi vsys). The same type of interfaces Dedicated HA links, or a combination of the management port and in-band ports that are set to interface type HA. Determine the IP address for the HA1 (control) connection between the HA peers. The HA1 IP address for both peers must be on the same subnet if they are directly connected or are connected to the same switch. The same set of licenses Licenses are unique to each firewall and cannot be shared between the firewalls. Therefore, you must license both firewalls identically. If both firewalls do not have an identical set of licenses, they cannot synchronize configuration information and maintain parity for a seamless failover.

7

8 1. Configure Interface E1/4 & E1/5 type HA respectively Network>Interfaces>Ethernet> Note:- Assign Interfaces to Respective VLAN/VMNET adapter Configure HA IP addresses based on following parameters Primary Secondary HA HA HA HA

9 2. Configure Primary PA with HA General Setup, Active/Passive Settings, Election Settings, Control link & Data link Device> High Availability>General

10 Add link group If added interface is down than assume it as failure & make Secondary as Active Commit The changes

11 3. View Primary PA HA on Dashboard

12 4. Configure IP address to MGMT interface & get GUI configure Entering configuration mode [edit] delete deviceconfig system type dhcp-client commit Management Interface configuration configure Entering configuration mode [edit] set deviceconfig system ip-address netmask commit

13 5. Configure Time Zone, Date according to PA1 & Unique Hostname

14 6. Configure Interface E1/4 & E1/5 type HA respectively on Secondary PA2 Network>Interfaces>Ethernet> Note:- Assign Interfaces to Respective VLAN/VMNET adapter Configure HA IP addresses based on following parameters Secondary HA HA

15 7. Configure Secondary PA2 with HA General Setup, Active/Passive Settings, Election Settings, Control link & Data link Note:-Set the numerical value in Device Priority. Make sure to set a lower numerical value on the firewall that you want to assign a higher priority to. If both firewalls have the same device priority value, the firewall with the lowest MAC address on the HA1 control link will become the active firewall.

16 8. View Secondary PA2 HA on Dashboard

17 9. Synchronize configuration between PA1 to PA2 Note: Always Sync from Primary to secondary

18 10. Compare the State after Synchronization of PA1 & PA2