Can you think of a time when you had a hardware or link failure in your network?
If you didn't have high availability,
the result may have been catastrophic.
This carries extra importance for firewalls,
as that's often where connections to the Internet and Wane looks like
we're now going to see how high availability works on Palo
Alto firewalls and how it's going to be
When it comes to high availability.
Palo Alto firewalls use the same two options as everyone else.
Option one is active passive, where one firewall is
in a passive state waiting to take over if there's a value.
Option two is active active where both firewalls
actively pass traffic.
Active passive is the simplest type of way to deploy.
In this model, one firewall is analyzing and passing the traffic learning routes
from routing protocols, maintaining information about sessions and so on.
The second firewall is turned on
and physically connected to the network, but it does not do much.
That's why it's called the passive firewall.
It's just waiting until it's needed.
It will synchronize information from the active firewall,
such as firewall configuration, session information and things like this.
If the active firewall fails, the passive
firewall is there to take over
the alternative option.
Active.
Active has both firewalls, processing traffic at the same time.
That is, they share the load.
If one of these firewalls fails, then the other one takes on the extra traffic.
Keep in mind that a single firewall needs
to be powerful enough to take on all the traffic.
If a failure like this happens.
Active.
Active is a bit more complicated to set up
as you need to think about how traffic is distributed between the pair
and how net pools are managed on each device.
We'll talk a little more about this and other active, active considerations
at the end of the video.
In both
models, each firewall has a priority inactive, passive.
This priority decides which firewall is active, inactive, active.
The priority decides which firewall is the active.
Primary firewall priority comes into play.
If preemption is enabled, which will see a little bit later.
This is also important when a failed firewall has been repaired
and added back into the path,
when configuring an HIPAA It is mandatory
to configure a few special links between the two firewalls.
Most Palo Alto firewalls come with dedicated ports for this.
In this model, we have the dedicated H1
and two ports.
One is called the control link.
These exchanges control plane type traffic between the two firewalls.
This includes heartbeat messages, state information
routing, table synchronization, and user ID
H2 is the data link
as it's used for sharing data plane type traffic.
This includes synchronizing sessions, forwarding tables,
IP set, total information and op information.
Not all models have the exact same port, so
the model shown here has H1 A and H1 B
which are the primary and backup control links
instead of a port named H2.
It has an HCI port.
This is a high speed data link.
Some of the bigger firewalls have an additional EU export
on the other end of the scale.
We have smaller firewalls which do not have any ports dedicated to.
We still have options, though, in a case like this.
We would configure some of the regular ports for each.
These are inbound ports.
We can even use the management port for the controlling if we want to
Even on the bigger models, we can still using band ports.
Think of this one again, which only has one HCI port for the Datalink.
In this case we can configure and in band port as a backup data link.
In fact, this is highly recommended and we'll see how this is configured in
a few moments. Time
When we're talking active.
Active.
We also need to configure an additional link called three.
This is a packet forwarding link
This is used when setting up sessions
and passing transit traffic from one firewall to another.
This link is entirely layered to
and uses Mac and Mac encapsulation.
You'll probably have noticed that there are no dedicated ports for this,
so we would need to configure an inbound port
the links can be run through external switches if you want them to.
The control links can be routed with traffic
passing through multiple subnets but where you can.
It's recommended to connect the firewall directly together.
All include a link to some best practices in the description.
If you want some extra reading
So obviously the point of air is to protect against failures.
Roughly speaking, we can group values into three categories.
The first is a firewall value
where one of the firewall stops working for some reason.
The second is uplink value, where a link connected to the firewall goes down.
The third is path failure where something upstream of the firewall fails.
Of course, there is a scenario which we're not talking about here,
which is when an administrator manually causes a failure
perhaps to install an update.
We look at that in the next video.
During regular operations, the firewall pass
and each other regular heartbeat messages across the controlling.
This is just a simple ICMP ping.
By default, these are sent out once per second.
And if three narrow did not arrive, then the partner is assumed to be lost.
We can change the heartbeat timer using
timer profiles, which we'll see briefly in a moment.
The recommended profile is a default, but there is also aggressive
or we can create our own.
Some high end firewalls perform
internal health checks This is not something we can configure.
It just happens on its own.
If a health check fails,
this will also mean the firewall has failed and trigger a failure.
Enabling failure
occurs when I linked directly connected to the firewall fails.
The firewall itself is fine though,
and we're not talking about our links here.
We're thinking about links to switches or routers.
Even if the firewall is alive, it won't be able to for traffic
so we configure the firewalls to watch the state of individual links
or groups of links and if enough of them fail.
This can trigger a fail over
The third consideration is path monitoring.
This is where something that is not directly connected to the firewall fails.
This might not sound so bad, but if it's a critical
upstream router, it can still break our network.
Depending on the way the network was designed.
We may want this to cause a failure of us so as to take an alternate path.
We can do this by configuring path monitoring,
which uses something like Ping to see if a device in the network is up.
And if it's not. The firewall can take action
Let's see how this is configured.
To give you a bit of background.
I'm configuring to Palo Alto. 3260s.
So far I've set a management IP on each.
But other than that, I have made no changes to the config.
The one A major one B ports are directly connected.
We've got six cables The HCI interface
is also directly connected with a ten gig twin DAC cable.
There's no dedicated backup to the data link.
So I've also cabled up the Ethernet one 20 ports.
We are now going to keep the active passive
Firstly, we'll check if pinging is enabled on the management interface.
This is not the most important thing for us in this specific case,
but if you have a smaller model, you might be using these interfaces
as your controlling and you'll remember that ping is used for heartbeats.
So we need to make sure this is allowed in any case.
For us, it's enabled out of the box
Next, we're going to select our ports.
This model already has three of our needed ports,
so we don't need to do anything special for them.
We do want Ethernet one 20
to be a backup bottleneck though, so we need to configure that.
Keep in mind that a backup link is optional
under the network tab, we go to interfaces.
If you look closely, the interface icon for Ethernet
one 20 is slightly different to the rest.
When we open the interface, we change the type to
and optionally out a comment
time for the real config.
This is in the device tab under high availability
in the setup area.
We add a group I.D.
This needs to match on both our firewalls.
This is also where we select whether we want active, passive, or active active.
We obviously values as active passive
We'll come back to the rest of these options later.
Next up is the control link.
That's the one interfaces
which are configured in the sections over on the right.
In port, we select the physical interface
that we want to use as the primary control link for us.
That's a one a This operates at layer three.
So we also need IP addressing.
I'm using 16925411 as this is a subnet
that should never be readable anywhere on my network.
That makes it a good choice for this out-of-band subnet.
Notice that we include a default gateway
We would use this if we have our firewalls in different subnets.
As I just mentioned, our two firewalls are in a nonrenewable subnet,
so we can leave this blank for this example.
Another option is encryption.
I'm not going to worry about that in my case, as these firewalls
are directly connected and they are secure server room.
So there's really no risk of anyone seeing this traffic.
It's the same procedure
for the backup controlling just use the H1-B interface.
Also assign a different subnet to the backup link.
The primary and backup cannot overlap
Now for the data link,
which is using the HCI port.
Notice that there are options for transport.
We're going to use Ethernet as our firewalls are directly connected.
However, if we connected them through external switches,
we would need to change this to TCP or UDP
and set an IP address.
We also want to make sure session synchronization is enabled
if it isn't and is a failover.
The new active router will need to build all of sessions again,
which would be disruptive to the flow of traffic.
And finally, let's enable key builds over a to.
This sends additional keep alive messages between the two firewalls.
This is
in addition to the hot bits we talked about earlier.
If the key block is going missing, then the firewalls know there's a problem.
This would be particularly useful if we're running these links or external switches
and there's an upstream value that the firewall wouldn't normally detect.
And of course, we're configuring the backup to link
using the Internet one to interface that we prepared earlier
in election settings.
We should enable heartbeat backup.
We do this because we're using dedicated interfaces.
If we were using the management port as our control link,
we wouldn't need to do this.
So what is it?
Heartbeat backup prevents a split brain scenario.
Imagine if one went down for any reason.
In this case, hot beats would go missing and both firewalls would think that the
other has failed.
They would then both try to become active.
The backup heartbeats use another path so the firewalls are able
to see if the other firewall is really down.
We can also set the device priority here if we want to.
This is optional, but it helps us to know which firewall is active
under normal circumstances.
The lower the value the more preferred
that firewall is
if both values are the same as they are by default,
then the lowest mark on A1
is used to break the tie
I like to enable preemption.
This means that if we replace a failed firewall
and the replacement has a better priority, it will automatically become active
Here is where you can change the timers that I spoke about earlier.
I would suggest leaving them as recommended unless you really have a
need to change them
by default.
A passive device will keep its interfaces
in a disabled state until it transitions to active.
Changing this to auto means that the interfaces on
the passive unit will always stay up.
This is a step toward faster failover,
but it might make troubleshooting more difficult
Even if we do this.
The passive unit will not forward any traffic through these interfaces.
So make sure that any switches or firewalls connected to these interfaces
are not trying to forward traffic through here based on link status.
If you find that you are inexplicably dropping traffic
maybe come back here and check this setting.
If you do set this to auto, you can also enable
LISP and LDAP renegotiation
This is the next step to fast failover
if you're just not sure.
Leave the shutdown.
Well, that's how prerequisites done.
So we can finally enable AIG.
This is in the same section that we saw earlier.
Make sure enable config sync is turned on.
If it's not the config will not be replicated from the active to passive.
We need to enter the IP of the device here
And finally, we're committing our changes.
The second unit needs to be configured to.
But as it's more or less the exact same as this one, I'll save your time
and pulls a video while I do that.
The second unit is now done.
If we go to the dashboard, we will be able to find a widget
for high availability
in this widget.
We can force a sync of information to the device.
Notice that the status of the device is active
and the conflict has been synchronized
If you're interested in active active, stick around.
We've got a few brief concepts to cover in the active active model.
Both firewalls need to forward traffic at the same time.
This comes with some extra considerations
when a session is created.
Which Firewall owns it?
How is traffic split across the two firewalls?
Is it evenly shared, or does one take a larger load?
How do you direct traffic to the right firewall?
And what happens if traffic arrives at the wrong firewall?
When you traffic reaches
the firewall, the firewall sets up a session.
This is where the firewall starts collecting information
about the flow of traffic so it can track it.
This is not specific to Asia at this point.
Even a standalone firewall will do this
when you have two active, active firewalls.
One firewall will become the session owner under normal circumstances.
This firewall will handle all traffic for the session If it fails,
the other firewall can take over as the session owner
in general.
The firewall that receives the first packet inflow
will become the session owner for that flow.
However, there are times when we might want to change that.
For example, we might want the active primary firewall to handle all traffic
for the purposes of packet capturing or some other troubleshooting
We might also decide to use another method
to determine which firewall becomes the owner.
The two other options are IP hash which uses
a hash of the source and destination IP to allocate sessions to the firewalls
or IP modulo, which uses the parity of the source IP
the firewall that receives
the first packet is often the best choice, but if we do that,
how can we split the traffic somewhat evenly across the firewalls?
That is, how do we prevent all traffic arriving at a single firewall
and that firewall becoming the owner of all traffic?
There are a few ways this could be done.
One option is to use Layer three routing where the upstream routers decide
which firewall a packet should be delivered to.
Or maybe a layer two floating IP
address with upload sharing would be better.
This is a bit like DRP.
A third option might be to use
an external hardware load balancer
The option you choose has to be the right one for your network.
But let's consider this scenario.
A packet arrives at one firewall and this firewall sets up a session
and becomes a session owner.
For some reason,
the next packet in the flow arrives on the other firewall.
What happens now
In this case, the packet needs to be passed on to the correct firewall.
That's what the three link is useful.
That's also why the three link is only needed for active active.
Right.
Once the packet is passed to the correct firewall,
it is processed as normal.
We've seen the two types
of high availability on Palo Alto firewalls.
Hang around for the next video where we will see
how to update these firewalls that have been configured as an HIPAA.