Configure Branch HA in a Hybrid Topology with Gen-1 (3000) and Gen-2 (3200) Platforms

Where Can I Use This?	What Do I Need?
Prisma SD-WAN	Active Prisma SD-WAN license

The example showcases an ION 3000 device and an ION 3200 device connected in an HA configuration equipped with a single pair of hardware bypass functionality.

The topology has the following features:

• The active device has one Internet connection.
• The backup device has one MPLS/Private connection.
• The ION devices operate in an active/backup configuration, and through fail-to-wire functionality, the active ION constantly maintains complete control and utilizes the full capacity of all the WAN circuits.
• The controller interface serves the purpose of monitoring device heartbeats. To achieve this, it's essential to establish a connection with a southbound switch.
• The LAN addressing is identical on both devices, permitting only the active device to use Address Resolution Protocol (ARP) and communicate with hosts and network devices below.
• The Controller addressing is unique, enabling the backup device to communicate with the controller through the active device for connectivity.
• Prisma SD-WAN facilitates the utilization of both the fabric overlay and the underlay (private MPLS). If you opt for the underlay, it's imperative to configure the necessary routing exchange between the ION device and the PE (peer edge) router.

In this topology, we consider ION 3000 to be the active device and ION 3200 to be the backup device.

1. Create physical connections between the interfaces of the active and backup ION device.

   1. Connect ION 1 Internet Bypass Port 2 to Port 1 of ION 2. (Internet)
   2. Connect Port 4 of ION 2 to Internet Port 1 of ION 1. (MPLS)

   This ensures that the Internet and MPLS circuits are available to both the ION devices.
2. Configure bypass pairs for each ION device.

   Creating a bypass pair will disrupt the interface's connectivity. Ensure that you have an alternative connection to the cloud controller before proceeding with this configuration.

   • Between Internet Port 2 and Internet Bypass 2 of the active ION device.
     (Port Internet 2 - WAN (Internet), Port Internet Bypass 2 - LAN)
   • Between Ports 3 and 4 of the standby ION device.
     (Port 3 - WAN (MPLS), Port 4 - LAN)

   Prisma SD-WAN facilitates the utilization of both the fabric overlay and the underlay (private MPLS). If you opt for the underlay, it's imperative to configure the necessary routing exchange between the ION device and the PE router.
3. Configure the controller interface.

   1. Configure Controller 1 of ION 1 (ION 3000).
   2. Configure Port 5 as the controller for ION 2 (ION 3200).

   The controller interface, used for handling High Availability (HA), is responsible for establishing connections between the devices and the controller. Consequently, it is crucial that these interfaces possess external reachability (direct or via overlay) and are configured with DNS servers capable of resolving public addresses.
4. Configure an interface for LAN connectivity.

   In this example, we are configuring Port LAN 1 (ION 1) and Port 7 (ION 2) to enable data exchange.

   You can use a single interface to transit to a layer 3 switch below, or alternatively, you can create multiple LAN subinterfaces and ports to communicate directly with different host subnets.

   If using a transit LAN to a layer 3 switch, you must also set up routing accordingly.

   The LAN addressing is identical on both devices, permitting only the active device to use Address Resolution Protocol (ARP) and communicate with the hosts and network devices in the LAN.
5. Add the ION Devices to the HA Groups.