PAN-OS · MANAGER

PAN-OS-style: two managers as a high-availability pair

A manager that is down stops every push. Two managers can work as an active/passive pair: only the active one pushes, and the passive one holds a copy of the running configuration. Each manager names the other as its peer, one is primary and the other secondary, and each firewall names both. MGR1 (10.0.0.5) already manages F1. MGR2 is new: it has no address yet.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Buddy Policy Manager · 5 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On F1: add the second manager’s address, set deviceconfig system panorama-server-2 10.0.0.6, and commit.
On MGR2: management address 10.0.0.6, high availability enabled, peer 10.0.0.5, priority secondary; commit. On MGR1: enabled, peer 10.0.0.6, priority primary; commit. show high-availability state: MGR1 is primary-active, MGR2 is secondary-passive, and the running configuration is synchronized.
On MGR1: request high-availability state suspend. MGR2 becomes secondary-active.
On MGR2: add the pre-rule NO-TELNET to device group SITE (deny application telnet from trust to untrust), commit, and push device group SITE. F1 takes it from MGR2.
On MGR1: request high-availability state functional (it comes back passive). On MGR2: request high-availability sync-to-remote running-config. Both show synchronized, and MGR1 has the rule.

Start this lab

Before you start

A passive or suspended manager refuses commit-all: try it. Without preemption the manager that took over stays active when the other one comes back. The pair synchronizes by itself when both were the same before a commit on the active unit; after a change made while the peer was away, you synchronize by hand, from the active unit. RouteBuddy has no clock, so a manager that is only unreachable does not lose the active role by itself.

Concept

A manager pair: only the active one pushes

Two managers can work as an active/passive pair. Each names the other as its peer, and one has priority primary, the other secondary. Only the active manager pushes to the firewalls. The passive one holds a copy of the running configuration, so it can take over. Each firewall names both managers.

Concept

A template holds the network, a device group holds the policy

A manager runs many firewalls from one place. Templates hold network settings, device groups hold rules and objects, and shared holds what every group gets. There are two steps: commit saves on the manager, and push sends what is committed to the firewalls. A firewall that refuses a push keeps what it had.