Failover Triggers
When a failure occurs on the active Panorama and the
passive Panorama takes over the task of managing the firewalls,
the event is called a failover. A failover is triggered when a monitored
metric on the active Panorama fails. This failure transitions the
state on the primary Panorama from active-primary to passive-primary,
and the secondary Panorama becomes active-secondary.
The conditions that trigger a failover are:
The Panorama peers cannot communicate with each other and the active peer does not respond to
health and status polls; the metric used is HA Heartbeat Polling and Hello
Messages.
When the Panorama peers cannot communicate with each other,
the active one monitors whether the peers are still connected before
a failover is triggered. This check helps in avoiding a failover
and causing a split-brain scenario, where both Panorama peers are
in an active state.
One or more of the destinations (IP addresses) specified on the active peer cannot be reached;
the metric used is HA Path Monitoring.
In addition to the failover triggers listed above, a failover
also occurs when the administrator places the Panorama peer in a
suspended state or when preemption occurs. Preemption is a preference
for the primary Panorama to resume the active role after recovering
from a failure (or user-initiated suspension). By default, preemption
is enabled and when the primary Panorama recovers from a failure
and becomes available, the secondary Panorama relinquishes control
and returns to the passive state. When preemption occurs, the event
is logged in the System log.
If you are logging to an NFS datastore, do not disable preemption
because it allows the primary peer (that is mounted to the NFS)
to resume the active role and write to the NFS datastore. For all
other deployments, preemption is only required if you want to make
sure that a specific Panorama is the preferred active peer.
HA Heartbeat Polling and Hello Messages
The HA peers use hello messages and heartbeats to verify that the peer is
responsive and operational. Hello messages are sent from one peer to the other
at the configured Hello Interval to verify the state of the other. The heartbeat
is an ICMP ping to the HA peer, and the peer responds to the ping to establish
that the peers are connected and responsive. By default, the interval is 1,000
milliseconds for the heartbeat and 8,000ms for hello messages.
HA Path Monitoring
Path monitoring checks the network connectivity and link state for an IP address
or group of IP addresses (path group). The active peer uses ICMP pings to verify
that one or more destination IP addresses can be reached. For example, you can
monitor the availability of interconnected networking devices like a router or a
switch, connectivity to a server, or some other vital device that is in the flow
of traffic. Make sure that the node/device configured for monitoring is not
likely to be unresponsive, especially when it comes under load, as this could
cause a path monitoring failure and trigger a failover.
The default ping interval is 5,000ms. An IP address is considered unreachable
when three consecutive pings (the default value) fail, and a peer failure is
triggered when any or all of the IP addresses monitored become unreachable. By
default, if any one of the IP addresses becomes unreachable, the HA state
transitions to non-functional.
