【Paloalto】HAの切り替え方法【CLI,GUI】

2023年2月27日

当ブログは広告リンクを含みます。

URLをコピーしました！

【Paloalto】HAの切り替え方法

paloalto（PA-200）で検証を行っています。今回はPaloalto（PA-200）で、HAの切り替え方法（CLI、GUI）をまとめていきます！

機種はPA-200
OSのバージョンはsw-version: 8.0.19
構成はActive/Passiveを想定

CLIで設定する方法

【CLI】HAを切り替える方法

↓CLIでHAステータスを確認するコマンド

###オペレーションモードで実行###
show high-availability state

↓CLIでHA切り替えを実行するコマンド

###オペレーションモードで実行###
request high-availability state suspend
request high-availability state functional

【CLI】HA切り替え実行結果

以下は実行結果になります。
まずはActive機にログインし、「show high-availability state」でHAステータスを確認します。

「PA-200-first」というホスト名がActiveで、peerの「PA-200-second」というホスト名がPassiveであることが初期状態だとします。

※意図的に「 Running Configuration: not synchronized 」にしておりますが、今回のHA切り替えにおいては無視してください。本来なら「synchronized」が理想です。

test-user@PA-200-first(active)> show high-availability state 
Group 10: 
  Mode: Active-Passive 
  Local Information: 
    Version: 1 
    Mode: Active-Passive 
    State: active (last 1 minutes) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.150/24 
      Management IPv6 Address: 
    HA1 Control Links Joint Configuration: 
      Encryption Enabled: no 
    Election Option Information: 
      Priority: 100 
      Preemptive: no 
    Version Compatibility: 
      Software Version: Mismatch 
      Application Content Compatibility: Match 
      Anti-Virus Compatibility: Match 
      Threat Content Compatibility: Match 
      VPN Client Software Compatibility: Match 
      Global Protect Client Software Compatibility: Match 
  Peer Information: 
    Connection status: up 
    Version: 1 
    Mode: Active-Passive 
    State: passive (last 1 minutes) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.151/24 
      Management IPv6 Address: 
      Connection up; Primary HA1 link 
      Connection up 
    Election Option Information: 
      Priority: 200 
      Preemptive: no 
  Configuration Synchronization: 
    Enabled: yes 
    Running Configuration: not synchronized 
      Out-of-sync Reason: Peer disconnected with commit 
test-user@PA-200-first(active)>

HA切り替えを実行するコマンドを入力します。
PA-200-firstがpassiveになりました。

test-user@PA-200-first(active)> request high-availability state suspend 
Successfully changed HA state to suspended 
test-user@PA-200-first(suspended)> request high-availability state functional 
Successfully changed HA state to functional 
test-user@PA-200-first(initial)> 
test-user@PA-200-first(initial)> 
test-user@PA-200-first(passive)>

HA切り替え後のHAステータスを確認します。Peer（PA-200-second）のステータスがActiveになり、PA-200-firstがPassiveになったのでHA切り替えが完了しました。

test-user@PA-200-first(passive)> show high-availability state 
Group 10: 
  Mode: Active-Passive 
  Local Information: 
    Version: 1 
    Mode: Active-Passive 
    State: passive (last 47 seconds) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.150/24 
      Management IPv6 Address: 
    HA1 Control Links Joint Configuration: 
      Encryption Enabled: no 
    Election Option Information: 
      Priority: 100 
      Preemptive: no 
    Version Compatibility: 
      Software Version: Mismatch 
      Application Content Compatibility: Match 
      Anti-Virus Compatibility: Match 
      Threat Content Compatibility: Match 
      VPN Client Software Compatibility: Match 
      Global Protect Client Software Compatibility: Match 
  Peer Information: 
    Connection status: up 
    Version: 1 
    Mode: Active-Passive 
    State: active (last 59 seconds) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.151/24 
      Management IPv6 Address: 
      Connection up; Primary HA1 link 
      Connection up 
    Election Option Information: 
      Priority: 200 
      Preemptive: no 
  Configuration Synchronization: 
    Enabled: yes 
    Running Configuration: not synchronized 
      Out-of-sync Reason: Peer disconnected with commit 
test-user@PA-200-first(passive)>

【CLI】HA切り替えTips

設定を元に戻すため、passiveになった機器（PA-200-first）からpeer(Active機、PA-200-second)をsuspend、functionalにして切り替えもできる。

わざわざpeer機器にログインしなくていいので楽

CLIコマンド

###オペレーションモードで実行###
request high-availability state peer suspend
request high-availability state peer functional

実行結果

test-user@PA-200-first(passive)> request high-availability state peer suspend 
Successfully changed peer HA state to suspended 
test-user@PA-200-first(active)> request high-availability state peer functional 
Successfully changed peer HA state to functional 
test-user@PA-200-first(active)> 
test-user@PA-200-first(active)> show high-availability state 
Group 10: 
  Mode: Active-Passive 
  Local Information: 
    Version: 1 
    Mode: Active-Passive 
    State: active (last 12 seconds) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.150/24 
      Management IPv6 Address: 
    HA1 Control Links Joint Configuration: 
      Encryption Enabled: no 
    Election Option Information: 
      Priority: 100 
      Preemptive: no 
    Version Compatibility: 
      Software Version: Mismatch 
      Application Content Compatibility: Match 
      Anti-Virus Compatibility: Match 
      Threat Content Compatibility: Match 
      VPN Client Software Compatibility: Match 
      Global Protect Client Software Compatibility: Match 
  Peer Information: 
    Connection status: up 
    Version: 1 
    Mode: Active-Passive 
    State: passive (last 2 seconds) 
    Last suspended state reason: User requested 
    Device Information: 
      Management IPv4 Address: 192.168.2.151/24 
      Management IPv6 Address: 
      Connection up; Primary HA1 link 
      Connection up 
    Election Option Information: 
      Priority: 200 
      Preemptive: no 
  Configuration Synchronization: 
    Enabled: yes 
    Running Configuration: not synchronized 
      Out-of-sync Reason: Peer disconnected with commit 
test-user@PA-200-first(active)>