Doubts regarding HA1 and HA2 HA-Config.
Good afternoon, again, thank you very much for the help, support and clarifications. Regarding the limitations and relating HA to HA1 and HA2 ports, after reviewing the existing documentation several times, I have the following question.
1.- In the case of HA1 with a dedicated port, thinking of firewalls that are not very close, on different floors, that can be interconnected through an extended layer 2 vlan, is this bearable, feasible and supported by Palo Alto Networks HA example configurations:PALO-ALTO-FW-01-HA1-port--------VLAN100------AccessSwitch----------Trunkport--------Switch-de- distribution-------------Acesess-Switch---------VLAN100----PALO-ALTO-FW02-HA1-port.
I hope you understand, node 1 of the PA, connected to an interface with a certain vlan ( vlan100 ) through layer 2 switches, including a trunk and then connected to the second Firewall Node Palo-Alto-Network-HA1, which will be connected in the same VLAN. Could you confirm if this is supported and indicate to nigel globla and general what parameters should be configured.
2.- In the case of HA2, using a Palo Alto dataplane interface, something similar to the above is possible, that is, through an extended vlan in layer 2, through switches that include trunks and terminate in switches and its corresponding access vlan.PALO-ALTO-FW-01-HA2-Data-plane-port--------VLAN200---------AccessSwitch----------Trunkport----- ---Distribution-Switch-----------Access-Switch----------VLAN200----PALO-ALTO-FW02-HA2-Dataplane-port.
Please your support for the clarification of these two cases, to indicate if this configuration is feasible and supported by Palo Alto, this since the equipment in HA in active-passive will not be physically in the same rack, but on floors of a building different, but connected through a layer 2 vlan, through access switches, including trunk, but if or if both ends belong to the same vlan.
Thank you very much for your support, I remain attentive.Best regards and attentive to your comments.
yes that is supported (both 1 and 2). you can even send HA1 connections through a router
tha transport medium doesn't matter, as long as both ends can see eachother via layer2 (vlan hopping and everything), or can be routed to eachother