Configure Active/Passive HA on AWS Using Interface Move
Table of Contents
10.0 (EoL)
Expand all | Collapse all
-
- VM-Series Deployments
- VM-Series in High Availability
- Enable Jumbo Frames on the VM-Series Firewall
- Hypervisor Assigned MAC Addresses
- Custom PAN-OS Metrics Published for Monitoring
- Interface Used for Accessing External Services on the VM-Series Firewall
- PacketMMAP and DPDK Driver Support
- Enable ZRAM on the VM-Series Firewall
-
- VM-Series Firewall Licensing
- Create a Support Account
- Serial Number and CPU ID Format for the VM-Series Firewall
- Install a License API Key
- Use Panorama-Based Software Firewall License Management
-
- Maximum Limits Based on Memory
- Activate Credits
- Create a Deployment Profile
- Manage a Deployment Profile
- Register the VM-Series Firewall (Software NGFW Credits)
- Provision Panorama
- Migrate Panorama to a FW-Flex License
- Transfer Credits
- Renew Your Software NGFW Credit License
- Deactivate License (Software NGFW Credits)
- Create and Apply a Subscription-Only Auth Code
- Migrate to a Flexible VM-Series License
- What Happens When Licenses Expire?
-
- Supported Deployments on VMware vSphere Hypervisor (ESXi)
-
- Plan the Interfaces for the VM-Series for ESXi
- Provision the VM-Series Firewall on an ESXi Server
- Perform Initial Configuration on the VM-Series on ESXi
- Add Additional Disk Space to the VM-Series Firewall
- Use VMware Tools on the VM-Series Firewall on ESXi and vCloud Air
- Use vMotion to Move the VM-Series Firewall Between Hosts
- Use the VM-Series CLI to Swap the Management Interface on ESXi
-
-
- VM-Series Firewall for NSX-V Deployment Checklist
- Install the VMware NSX Plugin
- Apply Security Policies to the VM-Series Firewall
- Steer Traffic from Guests that are not Running VMware Tools
- Dynamically Quarantine Infected Guests
- Migrate Operations-Centric Configuration to Security-Centric Configuration
- Add a New Host to Your NSX-V Deployment
- Use Case: Shared Compute Infrastructure and Shared Security Policies
- Use Case: Shared Security Policies on Dedicated Compute Infrastructure
- Dynamic Address Groups—Information Relay from NSX-V Manager to Panorama
-
- Supported Deployments of the VM-Series Firewall on VMware NSX-T (North-South)
- Components of the VM-Series Firewall on NSX-T (North-South)
-
- Install the Panorama Plugin for VMware NSX
- Enable Communication Between NSX-T Manager and Panorama
- Create Template Stacks and Device Groups on Panorama
- Configure the Service Definition on Panorama
- Deploy the VM-Series Firewall
- Direct Traffic to the VM-Series Firewall
- Apply Security Policy to the VM-Series Firewall on NSX-T
- Use vMotion to Move the VM-Series Firewall Between Hosts
- Extend Security Policy from NSX-V to NSX-T
-
- Components of the VM-Series Firewall on NSX-T (East-West)
- VM-Series Firewall on NSX-T (East-West) Integration
- Supported Deployments of the VM-Series Firewall on VMware NSX-T (East-West)
-
- Install the Panorama Plugin for VMware NSX
- Enable Communication Between NSX-T Manager and Panorama
- Create Template Stacks and Device Groups on Panorama
- Configure the Service Definition on Panorama
- Launch the VM-Series Firewall on NSX-T (East-West)
- Add a Service Chain
- Direct Traffic to the VM-Series Firewall
- Apply Security Policies to the VM-Series Firewall on NSX-T (East-West)
- Use vMotion to Move the VM-Series Firewall Between Hosts
-
- Install the Panorama Plugin for VMware NSX
- Enable Communication Between NSX-T Manager and Panorama
- Create Template Stacks and Device Groups on Panorama
- Configure the Service Definition on Panorama
- Launch the VM-Series Firewall on NSX-T (East-West)
- Create Dynamic Address Groups
- Create Dynamic Address Group Membership Criteria
- Generate Steering Policy
- Generate Steering Rules
- Delete a Service Definition from Panorama
- Migrate from VM-Series on NSX-T Operation to Security Centric Deployment
- Extend Security Policy from NSX-V to NSX-T
- Use In-Place Migration to Move Your VM-Series from NSX-V to NSX-T
- Use Migration Coordinator to Move Your VM-Series from NSX-V to NSX-T
-
-
- Deployments Supported on AWS
-
- Planning Worksheet for the VM-Series in the AWS VPC
- Launch the VM-Series Firewall on AWS
- Launch the VM-Series Firewall on AWS Outpost
- Create a Custom Amazon Machine Image (AMI)
- Encrypt EBS Volume for the VM-Series Firewall on AWS
- Use the VM-Series Firewall CLI to Swap the Management Interface
- Enable CloudWatch Monitoring on the VM-Series Firewall
-
- Use Case: Secure the EC2 Instances in the AWS Cloud
- Use Case: Use Dynamic Address Groups to Secure New EC2 Instances within the VPC
-
-
- What Components Does the VM-Series Auto Scaling Template for AWS (v2.0) Leverage?
- How Does the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1) Enable Dynamic Scaling?
- Plan the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1)
- Customize the Firewall Template Before Launch (v2.0 and v2.1)
- Launch the VM-Series Auto Scaling Template for AWS (v2.0)
- SQS Messaging Between the Application Template and Firewall Template
- Stack Update with VM-Series Auto Scaling Template for AWS (v2.0)
- Modify Administrative Account and Update Stack (v2.0)
-
- Launch the Firewall Template (v2.1)
- Launch the Application Template (v2.1)
- Create a Custom Amazon Machine Image (v2.1)
- VM-Series Auto Scaling Template Cleanup (v2.1)
- SQS Messaging Between the Application Template and Firewall Template (v2.1)
- Stack Update with VM-Series Auto Scaling Template for AWS (v2.1)
- Modify Administrative Account (v2.1)
- Change Scaling Parameters and CloudWatch Metrics (v2.1)
-
-
- Enable the Use of a SCSI Controller
- Verify PCI-ID for Ordering of Network Interfaces on the VM-Series Firewall
-
- Deployments Supported on Azure
- Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)
- Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)
- Create a Custom VM-Series Image for Azure
- Deploy the VM-Series Firewall on Azure Stack
- Enable Azure Application Insights on the VM-Series Firewall
- Set up Active/Passive HA on Azure
- Use the ARM Template to Deploy the VM-Series Firewall
-
- About the VM-Series Firewall on Google Cloud Platform
- Supported Deployments on Google Cloud Platform
- Prepare to Set Up VM-Series Firewalls on Google Public Cloud
- Create a Custom VM-Series Firewall Image for Google Cloud Platform
-
- Deploy the VM-Series Firewall from Google Cloud Platform Marketplace
- Management Interface Swap for Google Cloud Platform Load Balancing
- Use the VM-Series Firewall CLI to Swap the Management Interface
- Enable Google Stackdriver Monitoring on the VM Series Firewall
- Enable VM Monitoring to Track VM Changes on Google Cloud Platform (GCP)
- Use Dynamic Address Groups to Secure Instances Within the VPC
- Use Custom Templates or the gcloud CLI to Deploy the VM-Series Firewall
-
- Prepare Your ACI Environment for Integration
-
-
- Create a Virtual Router and Security Zone
- Configure the Network Interfaces
- Configure a Static Default Route
- Create Address Objects for the EPGs
- Create Security Policy Rules
- Create a VLAN Pool and Domain
- Configure an Interface Policy for LLDP and LACP for East-West Traffic
- Establish the Connection Between the Firewall and ACI Fabric
- Create a VRF and Bridge Domain
- Create an L4-L7 Device
- Create a Policy-Based Redirect
- Create and Apply a Service Graph Template
-
- Create a VLAN Pool and External Routed Domain
- Configure an Interface Policy for LLDP and LACP for North-South Traffic
- Create an External Routed Network
- Configure Subnets to Advertise to the External Firewall
- Create an Outbound Contract
- Create an Inbound Web Contract
- Apply Outbound and Inbound Contracts to the EPGs
- Create a Virtual Router and Security Zone for North-South Traffic
- Configure the Network Interfaces
- Configure Route Redistribution and OSPF
- Configure NAT for External Connections
-
-
- Choose a Bootstrap Method
- VM-Series Firewall Bootstrap Workflow
- Bootstrap Package
- Bootstrap Configuration Files
- Generate the VM Auth Key on Panorama
- Create the bootstrap.xml File
- Prepare the Licenses for Bootstrapping
- Prepare the Bootstrap Package
- Bootstrap the VM-Series Firewall on AWS
- Bootstrap the VM-Series Firewall on Azure
- Bootstrap the VM-Series Firewall on Google Cloud Platform
- Verify Bootstrap Completion
- Bootstrap Errors
End-of-Life (EoL)
Configure Active/Passive HA on AWS Using Interface Move
Complete the following procedure to configure
active-passive HA using interface move mode.
All VM-Series
firewall interfaces must be assigned an IPv4 address when deployed
in a public cloud environment. IPv6 addresses are not supported.
- Make sure that you have followed the prerequisites.For deploying a pair of VM-Series firewalls in HA in the AWS cloud, you must ensure the following:
- Select the
IAM role you created when launching the VM-Series firewall on an
EC2 instance; you cannot assign the role to an instance that is
already running. See IAM
Roles for HA.For detailed instructions on creating an IAM role, defining which accounts or AWS services can assume the role, and defining which API actions and resources the application can use upon assuming the role, refer to the AWS documentation.
- DPDK is not supported on the VM-Series firewall on AWS in an interface-move HA deployment. If your have VM-Series plugin 2.0.1 or later on your firewalls, you must disable DPDK.Disabling DPDK requires the firewall to reboot. If you are using bootstrapping to deploy the VM-Series firewall, you can avoid rebooting the firewall by disabling DPDK in the initi-cfg.txt file by using op-cmd-dpdk-pkt-io=off. See Bootstrap the VM-Series Firewall on AWS for more information.
- The active firewall in the HA pair must have at a minimum three
ENIs: two dataplane interfaces and one management interface.The passive firewall in the HA pair, must have one ENI for management, and one ENI that functions as dataplane interface; you will configure the dataplane interface as an HA2 interface.Do not attach additional dataplane interfaces to the passive firewall in the HA pair. On failover, the dataplane interfaces from the previously active firewall are moved —detached and then attached—to the now active (previously passive) firewall.
- The HA peers must be deployed in the same AWS availability zone. While VM-Series HA Across AWS Availability Zones is not a recommended solution, it is supported.
- Select the
IAM role you created when launching the VM-Series firewall on an
EC2 instance; you cannot assign the role to an instance that is
already running. See IAM
Roles for HA.
- Launch the VM-Series Firewall on AWS.
- (VM-Series plugin 2.0.1 or later) Disable DPDK
on the active and passive firewalls. DPDK is enabled by default
and interface-move HA mode does not support DPDK, so you must disable
it; enabling Packet MMAP.
- Log in to the passive firewall CLI.
- Disable DPDK using the following command. Executing
this command restarts the firewall.admin@PA-VM> set system setting dpdk-pkt-io off
- Enable
HA.
- Select DeviceHigh AvailabilityGeneral, and edit the Setup section.
- Select Enable HA.
- Configure ethernet 1/1 as an HA interface. This interface
must be used for HA2 communication.
- Select NetworkInterfaces.
- Confirm that the link state is up on ethernet1/1.
- Click the link for ethernet1/1 and set the Interface Type to HA.
- Set up the Control Link (HA1) to use the management port.
- Select DeviceHigh AvailabilityGeneral, and edit the Control Link (HA1) section.
- (Optional) Select Encryption Enabled,
for secure HA communication between the peers. To enable encryption,
you must export the HA key from a device and import it into the
peer device.
- Select DeviceCertificate ManagementCertificates.
- Select Export HA key. Save the HA key to a network location that the peer device can access.
- On the peer device, navigate to DeviceCertificate ManagementCertificates, and select Import HA key to browse to the location that you saved the key and import it in to the peer device.
- Set up the Data Link (HA2) to use ethernet1/1.
- Select DeviceHigh AvailabilityGeneral, edit the Data Link (HA2) section.
- Select Port ethernet1/1.
- Enter the IP address for ethernet1/1. This IP address must be the same that assigned to the ENI on the EC2 Dashboard.
- Enter the Netmask.
- Enter a Gateway IP address if the HA1 interfaces are on separate subnets.
- Select IP or UDP for Transport. Use IP if you need Layer 3 transport (IP protocol number 99). Use UDP if you want the firewall to calculate the checksum on the entire packet rather than just the header, as in the IP option (UDP port 29281).
- (Optional) Modify the Threshold for HA2
Keep-alive packets. By default, HA2 Keep-alive is enabled
for monitoring the HA2 data link between the peers. If a failure
occurs and this threshold (default is 10000 ms) is exceeded, the
defined action will occur. A critical system log message is generated
when an HA2 keep-alive failure occurs.You can configure the HA2 keep-alive option on both devices, or just one device in the HA pair. If you enable this option on one device, only that device will send the keep-alive messages.
- Set the device priority and enable preemption.Use this setting if you want to make sure that a specific device is the preferred active device. For information, see Device Priority and Preemption.
- Select DeviceHigh AvailabilityGeneral and edit the Election Settings section.
- Set the numerical value in Device Priority.
Make sure to set a lower numerical value on the device that you
want to assign a higher priority to.If both firewalls have the same device priority value, the firewall with the lowest MAC address on the HA1 control link will become the active device.
- Select Preemptive.You must enable preemptive on both the active and the passive device.
- Modify the failover timers. By default, the HA timer profile is set to the Recommended profile and is suited for most HA deployments.
- (Optional) Modify the wait time before a failover
is triggered.
- Select DeviceHigh AvailabilityGeneral and edit the Active/Passive Settings.
- Modify the Monitor fail hold up time to a value between 1-60 minutes; default is 1 minute. This is the time interval during which the firewall will remain active following a link failure. Use this setting to avoid an HA failover triggered by the occasional flapping of neighboring devices.
- Configure
the IP address of the HA peer.
- Select DeviceHigh AvailabilityGeneral, and edit the Setup section.
- Enter the IP address of the HA1 port on the peer. This is the IP address assigned to the management interface (ethernet 0/0), which is also the HA1 link on the other firewall.
- Set the Group ID number between 1 and 63. Although this value is not used on the VM-Series firewall on AWS, but cannot leave the field blank.
- Configure the other peer.
- After you finish configuring both devices, verify that
the devices are paired in active/passive HA.
- Access the Dashboard on both devices, and view the High Availability widget.
- On the active device, click the Sync to peer link.
- Confirm that the devices are paired and synced, as
shown below:
- On the passive device: The state of the local device should display passive and the configuration is synchronized.
- On the active device: The state of the local device should display active and the configuration is synchronized.
- Verify that failover occurs properly.
- Verify the HA mode.show plugins vm_series aws ha failover-mode
- Verify that the packet IO mode is set to packet MMAP.show system setting dpdk-pkt-io
- Shut down the active HA peer.
- On the EC2 Dashboard, select Instances.
- From the list, select the VM-Series firewall and click ActionsStop.
- Check that the passive peer assumes the role of the active peer and that the dataplane interfaces have moved over to the now active HA peer.
- Verify the HA mode.