3.3 High Availability Active/Active Architecture and HA Clustering

3.3 High Availability Active/Active Architecture and HA Clustering

While Active/Passive HA is the standard design for most enterprise perimeter deployments, certain complex network environments demand concurrent processing of traffic across multiple firewall appliances. Active/Active High Availability in Palo Alto Networks PAN-OS allows both firewall nodes to concurrently process data traffic, providing seamless security enforcement in networks characterized by asymmetric routing paths or multi-homed Layer 3 core designs. Furthermore, PAN-OS 11.x introduced HA Clustering, scaling high availability beyond traditional two-node pairs into multi-node resiliency meshes.

---

Active/Active HA Mechanics and Use Cases

In an Active/Active topology, both firewalls are in the Active state simultaneously (designated as Active-Primary and Active-Secondary).

Core Use Cases for Active/Active HA:

1. Asymmetric Network Routing: In networks where outbound traffic egresses through Firewall A, but return inbound traffic ingresses through Firewall B (due to asymmetric BGP paths or ECMP routing), Active/Active HA ensures both firewalls coordinate session tracking without dropping asymmetric packets.
2. Virtual Wire (VWire) In-Inline Topologies: Dual redundant VWire paths where traffic dynamically traverses either physical firewall path based on upstream switch fabric state.
3. Transitional Layer 3 Topologies: Environments requiring active-active default gateway resilience via ARP load sharing.

---

HA Interface Links in Active/Active Mode: The HA3 Link

Active/Active HA utilizes the standard HA1 (Control) and HA2 (Data) links, but introduces a third mandatory interconnect: the HA3 Link (Packet Forwarding Link).

• HA3 Function: The HA3 link is a dedicated, high-speed raw Ethernet interface used exclusively to forward asymmetric data packets between the Active-Primary and Active-Secondary firewalls.
• Encapsulation: Packets passing across HA3 use custom PAN-OS raw Ethernet encapsulation. Jumbo frame support (MTU 9192+) is strongly recommended on HA3 interfaces to prevent packet fragmentation.
• Asymmetric Traffic Flow: If Firewall B receives a packet belonging to a session owned by Firewall A, Firewall B encapsulates the packet and redirects it across HA3 to Firewall A for security inspection, returning the packet across HA3 for egress if necessary.

---

Session Ownership vs. Session Setup Device

To enforce stateful inspection and layer 7 security policies across asymmetric flows, PAN-OS Active/Active HA divides session management into two distinct node roles:

1. Session Setup Device

• The firewall node that receives the initial packet of a new session (e.g., the TCP SYN packet).
• Performs initial session allocation, assigns a unique Session ID, determines session ownership based on configured criteria, and replicates session information to the peer via HA2.

2. Session Owner Device

• The firewall node assigned primary responsibility for performing App-ID classification, Content-ID threat inspection, URL filtering, and Security Policy evaluation for the life of the session.
• Session Owner Determination Modes:
  • First Packet: The node that receives the first packet becomes the Session Owner.
  • IP Hash: Session ownership is determined by hashing the source/destination IP addresses, ensuring symmetrical session handling regardless of which firewall receives the initial packet.
  • Session MAC: Ownership is tied to the Virtual MAC address receiving the frame.

[Client Initiates Session]
       |
       v
(Firewall B: Session Setup Device) ---[HA3 Link Packet Forwarding]---> (Firewall A: Session Owner Device)
 Receives initial TCP SYN packet                                         Performs App-ID, Content-ID, & NAT
 Determines Owner = Firewall A                                           Enforces Security Policy

---

Layer 3 Active/Active Topologies: Floating IPs and ARP Load Sharing

In Layer 3 Active/Active deployments, PAN-OS uses virtual IP configurations to manage active traffic distribution:

• Floating IP Addresses: IP addresses that can dynamically move between Active-Primary and Active-Secondary firewalls if an interface or node fails. Floating IPs are used as default gateways for internal endpoints.
• Virtual MAC (VMAC) Addresses: Each active firewall is assigned a unique VMAC. In ARP Load Sharing mode, both firewalls respond to ARP requests for floating gateway IPs using their respective VMACs, balancing host traffic across both firewalls.
• Non-Floating IPs: Bound permanently to a specific physical interface on a single firewall unit.

---

Modern HA Clustering (PAN-OS 11.x+)

Traditional PAN-OS HA was strictly limited to two-node pairs (Active/Passive or Active/Active). In PAN-OS 11.x, Palo Alto Networks introduced HA Clustering, enabling enterprise organizations and cloud service providers to group up to 16 nodes into a unified High Availability Cluster.

Key Features of HA Clustering:

• Node Scale: Supports up to 16 cluster nodes for VM-Series virtual firewalls and chassis/hardware appliances.
• Full Mesh Control & State Sync: Cluster nodes maintain mesh connectivity over cluster control and cluster data links, replicating session tables, ARP entries, and runtime state across all cluster members.
• N+M Redundancy: If any single cluster node (or multiple nodes) fails, remaining cluster nodes automatically take over active session processing without service disruption.
• Automated Configuration Push: Centralized configuration changes committed on the primary cluster node auto-synchronize across all 16 cluster members instantaneously.

---

High Availability Architecture Comparison