How to configure template Variables for High Availability Active/Passive
13678
Created On 01/20/20 16:47 PM - Last Modified 02/20/20 22:51 PM
Objective
- Prior to 8.1.x, the HA IP addresses couldn't be configured because in Active/Passive both firewalls shared the same template and hence users will get configuration errors.
- In 8.1.x we can now use Variables to assign HA IP addresses and have the firewalls in the same template.
Environment
- HA Active/Passive
- Panorama M-500
- PAN-OS v 9.0.4
Procedure
Below are step by step configuration to setup variables for HA.
1) We need to create the variables under the template. Create two variables. One for local HA1 IP address and the second for Peer HA1 IP address. You can also do the same for backup links and HA2 as needed. See below snippet of the two variables we created
2) Next, Go to the High Availability Settings for the template that you wish to assign the variables. In this case our template name is "Variables-Template".
3) Under the setup tab, Assign $HA1-peer variable to Peer HA1 IP Address
4) Click on Control Link (HA1) and Assign $HA1-local variable to IPv4/IPv6 Address.
5) Next, Click on Panorama tab and then Managed Devices.
6) Select One of the device that are part of the template, under Variables click Create. (You only need to perform this step for one of the device)
7) Click "No" under Create Device Variable Definition.
8) Select the Variables and click Override. Assign the appropriate IP address.
9) Commit the changes to Panorama and then Push to the devices.
10) Login to the respective devices and verify the IP-address. Below is HA IP address from one of the devices.
Additional Information
For further details on templates and template variables, please click HERE for the Palo Alto Networks technical documentation.
For video instruction on how to accomplish this, please see the following youtube instructional video:
Creating and Using Template Variables