Configure HA clustering on up to 16 firewalls to protect against failure of data center communications or to achieve horizontal scaling.
A number of Palo Alto Networks
®firewall models now support session state synchronization among firewalls in a high availability (HA) cluster of up to 16 firewalls. The HA cluster peers synchronize sessions to protect against failure of the data center or a large security inspection point with horizontally scaled firewalls. In the case of a network outage or a firewall going down, the sessions fail over to a different firewall in the cluster.
HA clusters support a Layer 3 or virtual wire deployment. HA peers in the cluster can be a combination of HA pairs and standalone cluster members. All cluster members share session state. When a new firewall joins an HA cluster, that triggers all firewalls in the cluster to synchronize all existing sessions. The new, required HA4 and HA4 backup connections are the dedicated cluster links that synchronize session state among all cluster members having the same cluster ID. The HA4 link between cluster members detects connectivity failures between cluster members.
The firewall models that support HA clustering and the maximum number of members supported per cluster are as follows:
Number of Members Supported Per Cluster
PA-7000 Series firewalls that have at least one of the following cards: PA-7000-100G-NPC, PA-7000-20GQXM-NPC, PA-7000-20GXM-NPC
Follow the HA Clustering Best Practices and Provisioning requirements to ensure compatibility and consistent security enforcement, for example.
- Configure two HA interfaces (to assign as the HA4 and HA4 backup links).
- Enable HA clustering.
- Selectand edit the Clustering Settings.DeviceHigh AvailabilityGeneral
- Enable Cluster Participation.
- Enter theCluster IDand configure the Clustering Settings.
- Configure the HA4 link.
- SelectHA Communicationsand in the Clustering Links section, edit the HA4 section.
- Select the interface you configured as anHAinterface to be thePortfor the HA4 link; for example, ethernet1/1.
- Enter theIPv4/IPv6 Addressof the local HA4 interface.
- Enter theNetmask.
- (Optional) Configure the HA4 Keep-alive Threshold.
- Configure the HA4 Backup link by editing the HA4 Backup section in a similar manner.
- Specify all members of the HA cluster, including the local member and both HA peers in any HA pair.
- SelectCluster Config.
- Adda peer member’sDevice Serial Number.
- Select the device andEnableit.
- Define HA failover conditions with link and path monitoring.
- SelectDashboardto view HA cluster information in the web interface.
Recommended For You
Recommended videos not found.