Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT

This Layer 3 interface example uses NAT in Active/Active HA Mode and ARP Load-Sharing with destination NAT. Both HA firewalls respond to an ARP request for the destination NAT address with the ingress interface MAC address. Destination NAT translates the public, shared IP address (in this example, 10.1.1.200) to the private IP address of the server (in this example, 192.168.2.200).

When the HA firewalls receive traffic for the destination 10.1.1.200, both firewalls could possibly respond to the ARP request, which could cause network instability. To avoid the potential issue, configure the firewall that is in active-primary state to respond to the ARP request by binding the destination NAT rule to the active-primary firewall.

On PA-3050-2 (Device ID 1), perform Step 1 through Step 3 of Configure Active/Active HA.
Enable active/active HA.
In
Device
High Availability
General
, edit Setup.
Select
Enable HA
.
Enter a
Group ID
, which must be the same for both firewalls. The firewall uses the Group ID to calculate the virtual MAC address (range is 1 to 63).
(
Optional
) Enter a
Description
.
For
Mode
, select
Active Active
.
Select
Device ID
to be
1
.
Select
Enable Config Sync
. This setting is required to synchronize the two firewall configurations (enabled by default).
Enter the
Peer HA1 IP Address
, which is the IP address of the HA1 control link on the peer firewall.
(
Optional
) Enter a
Backup Peer HA1 IP Address
, which is the IP address of the backup control link on the peer firewall.
Click
OK
.
Perform Step 6 through Step 15 in Configure Active/Active HA.
Configure an HA virtual address.
Select
Device
High Availability
Active/Active Config
Virtual Address
and click
Add
.
Select
Interface
eth1/1.
Select
IPv4
and
Add
an
IPv4 Address
of 10.1.1.200.
For
Type
, select
ARP Load Sharing
, which configures the virtual IP address to be for both peers to use for ARP Load-Sharing.
Configure ARP Load-Sharing.
The device selection algorithm determines which HA firewall responds to the ARP requests to provide load sharing.
For
Device Selection Algorithm
, select
IP Modulo
. The firewall that will respond to ARP requests is based on the parity of the ARP requester's IP address.
Click
OK
.
Enable jumbo frames on firewalls other than the PA-7000 Series.
Define HA Failover Conditions.
Commit
the configuration.
Configure the peer firewall, PA-3050-1 (Device ID 0), with the same settings, except in Step 2 select
Device ID 0
.
Still on PA-3050-1 (Device ID 0), create the destination NAT rule so that the active-primary firewall responds to ARP requests.
Select
Policies
NAT
and click
Add
.
Enter a
Name
for the rule that, in this example, identifies it as a destination NAT rule for Layer 2 ARP.
For
NAT Type
, select
ipv4
(default).
On the
Original Packet
, for
Source Zone
, select
Any
.
For
Destination Zone
, select the Untrust zone you created for the external network.
Allow
Destination Interface
,
Service
, and
Source Address
to remain set to
Any
.
For
Destination Address
, specify 10.1.1.200.
For the
Translated Packet
, Source Address Translation remains
None
.
For
Destination Address Translation
, enter the private IP address of the destination server, in this example, 192.168.1.200.
On the
Active/Active HA Binding
tab, for
Active/Active HA Binding
, select
primary
to bind the NAT rule to the firewall in active-primary state.
Click
OK
.
Commit
the configuration.