PAN-OS · HIGH AVAILABILITY

PAN-OS-style: test a failover, and give the role back

F1 and F2 are a working active/passive pair. Before you trust a pair, test it: move the role to F2 on purpose, check that traffic still flows, and move it back. A suspended unit can’t take the role, so it must be made functional first.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Cisco switches · 5 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

show high-availability state on both: F1 is active, F2 is passive.
PC1 reaches 198.51.100.1 through F1.
On F1: request high-availability state suspend. F1 is suspended, F2 is active, and F2’s log has the switch.
PC1 still reaches 198.51.100.1, now through F2: the addresses moved with the role.
Give the role back. On F1: request high-availability state functional (F1 is passive again). Then on F2: request high-availability state suspend, and make F2 functional too. F1 is active, and PC1 still reaches 198.51.100.1.

Start this lab

Before you start

Suspend is the planned way to move the role, for an upgrade or a test. The unit you suspend stays out of the election until you make it functional. A unit that comes back does not take the role back by itself, so moving it back is a second, deliberate step. Try suspending F2 while F1 is still suspended: it is refused, because nothing could take over.

Concept

One active unit, and the addresses move with the role

Two units watch each other over an HA1 link. The active one answers on the interface addresses, and the passive one copies its configuration and keeps its links quiet. If the active unit fails or is suspended, the passive one takes over with the same addresses, so hosts keep their gateway. Each unit keeps its own HA settings, management address and host name.