Configure Branch HA for Platforms without Bypass Pairs

Where Can I Use This?	What Do I Need?
Prisma SD-WAN	Active Prisma SD-WAN license

The example features two ION 1000 devices that do not natively provide hardware bypass capabilities. To ensure high availability (HA), we opt to terminate the circuits into both the ION devices. Although connecting these circuits via a northbound switch is the most likely physical design, for the sake of simplicity, we illustrate the circuits going directly into both devices. It's important to note that this design is flexible and can be adapted to accommodate any model ION, not solely limited to the ION 1000 platform. These ION devices represent a significant leap in software-defined enterprise technology.

The topology has the following features:

• Both the active and backup devices are connected to circuits, each necessitating its own unique IP address.
• The ION devices function in an active/backup configuration, but the WAN interfaces will consistently remain active, necessitating their own unique addressing.
• The devices establish a connection with the LAN switch through a trunk, facilitating both data connectivity and enabling High Availability (HA) via device heartbeat monitoring.
• The LAN addressing is identical on both devices, permitting only the active device to use Address Resolution Protocol (ARP) and communicate with hosts and network devices below. In contrast, the High Availability (HA) addressing is unique, enabling the backup device to communicate with the controller through the active device for connectivity.
• Prisma SD-WAN facilitates the utilization of both the fabric overlay and the underlay (private MPLS). If you opt for the underlay, it's imperative to configure the necessary routing exchange between the ION device and the PE (peer edge) router.

1. Configure the internet port.

   Configure Port 1 as the internet port on both the ION devices.

   The ION devices function in an active/backup configuration, but the WAN interfaces will consistently remain active, necessitating their own unique addressing.
2. Configure the WAN port.

   configure Port 2 for Private WAN (MPLS) on both the ION devices.

   The ION devices function in an active/backup configuration, but the WAN interfaces will consistently remain active, necessitating their own unique addressing.

   Prisma SD-WAN facilitates the utilization of both the fabric overlay and the underlay (private MPLS). If you opt for the underlay, it's imperative to configure the necessary routing exchange between the ION device and the PE router.
3. Configure High Availability (HA) (Used-for-HA) interface.

   In this example, we are configuring a subinterface on port 3 with VLAN tag 130 as the Used-for-HA interface for heartbeat exchange between the devices.

   The interface designated for handling High Availability (HA) will be responsible for establishing connections between the devices and the controller. Consequently, it is crucial that these interfaces possess external reachability (direct or via overlay) and are configured with DNS servers capable of resolving public addresses.
4. Configure an interface for LAN connectivity.

   In this example, we are configuring a subinterface on port 3 with VLAN tag 100 for LAN connectivity to enable data exchange between the devices.

   You can use a single interface to transit to a layer 3 switch below, or alternatively, you can create multiple LAN subinterfaces and ports to communicate directly with different host subnets.

   If using a transit LAN to a layer 3 switch, you must also set up routing accordingly.

   The LAN addressing is identical on both devices, permitting only the active device to use Address Resolution Protocol (ARP) and communicate with the hosts and network devices in the LAN.
5. Add the ION Devices to the HA Groups.