topic Re: Deploy PA firewall HA in different availability zone in Azure in VM-Series in the Public Cloud

Deploy PA firewall HA in different availability zone in Azure

alextsa — Sat, 10 Apr 2021 08:14:29 GMT

Hi all

Understand PA HA deployment supported since PAN-OS 9.0, so firewall pair can be deployed in the availability set so they are in different hardware cluster in Azure. But may I know anyone tried to form the HA in different availability zone in the same Azure region? Support or not?

Best regards

Alex Tsang

Re: Deploy PA firewall HA in different availability zone in Azure

ssyed — Mon, 12 Apr 2021 19:22:38 GMT

We recommend deploying firewalls in separate AZs or at least put them into an Availability Set in Azure. HA mode is supported as well but not typically recommended. The load balancer method is recommended. You can see both setups in our reference architecture guide. https://www.paloaltonetworks.com/resources/guides/azure-architecture-guide

Re: Deploy PA firewall HA in different availability zone in Azure

JimMcGrady — Tue, 22 Jun 2021 04:31:30 GMT

From what i can see, the issue is that the VM-series firewall available from Azure Marketplace does not facilitate choosing an Availability Zone. And once the firewall is created, there is no reasonable way to move it into an AZ.

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Tue, 22 Jun 2021 05:47:37 GMT

I would also like to know how to install it as the only method of deployment in Azure I know of is through marketplace..

Or is there some kind of ovf file provided which we can use for installation.

Re: Deploy PA firewall HA in different availability zone in Azure

tostern — Tue, 22 Jun 2021 06:13:22 GMT

Good morning @raji_toor and @JimMcGrady

The Azure Marketplace offering has limited features and you can't deploy two firewalls over the marketplace in a single Ressource Group.

That why we are using Terraform templates or ARM templates. Below are the link to the ARM Templates with the examples how to use it.

ARM Templates: https://github.com/wwce/azure-arm

Terraform provider: https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/azurerm/latest

How to setup HA in Azure: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure.html

i hope i could help you.

Regards,

Torsten

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Tue, 22 Jun 2021 15:24:00 GMT

@tostern Thanks. But PA needs to better their documentation regarding Azure deployments. While the Github mentions 3 models (Shared, Scaled and Dedicated). There is little explanation for each them and also there is no mention of them in the design guide. I understand and have tested implementation of both options with HA/without HA(load balancer) options. From what I understand the template I will use is shared model here and Transit VNet model (Common Firewall Option).

And I had got it working in HA without ARM template for those who are not comfortable using it. Install in dedicated resource group and then move the resources to another resource group where you want both firewalls to be.

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Tue, 22 Jun 2021 16:34:31 GMT

And interestingly we get the pricing for a 2vCPU deployment but azure VM does not support more than 2 NICS, if i try to deploy with arm template a VM with 2 vCPU.

Re: Deploy PA firewall HA in different availability zone in Azure

US_SOC_Analyst — Tue, 22 Jun 2021 20:18:48 GMT

Great to hear the recommended architecture.

What's the reason you say HA is not recommended?

And why do you recommend load balancer over floating IP?

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Tue, 22 Jun 2021 23:28:30 GMT

@US_SOC_Analyst because of 3-4 minutes downtime when doing failover, with failover its alomost instant..no session persistence with either.

Also have to maintain a servie principal which has to be renewed every 2 years

Re: Deploy PA firewall HA in different availability zone in Azure

US_SOC_Analyst — Tue, 22 Jun 2021 23:29:54 GMT

Thank you for your response.

>No session persistence with either.

Does this mean if we have HA configured firewall, the session is not shared between the HA pair?

That sounds pretty weird, then what's that HA configuration for?

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Wed, 23 Jun 2021 07:02:33 GMT

Sessions are synced but if you failover from active to passive it takes 3-4 mins for other firewall to become active and the network remains down all this time. After this much time session persistence is pointless. Its a limitation of Azure that HA can't work the way it would on physical network.

Re: Deploy PA firewall HA in different availability zone in Azure

tostern — Wed, 23 Jun 2021 07:35:16 GMT

Hi @US_SOC_Analyst,

you can find the the reference architecture here.

PANW does not recommend native HA in because of the long failover time as @raji_toor already described. With LB sandwich you have better resilience.

Regards,

Torsten

Re: Deploy PA firewall HA in different availability zone in Azure

US_SOC_Analyst — Wed, 23 Jun 2021 16:28:23 GMT

@raji_toor @tostern

Thank you for the clarification.

Then, is HA recommended when we use a load balancer for failover?

Re: Deploy PA firewall HA in different availability zone in Azure

raji_toor — Wed, 23 Jun 2021 17:08:22 GMT

@US_SOC_Analyst no you do not need to use HA for LB option. LB will itself divert all traffic to the other PA when one becomes unavailable.

Re: Deploy PA firewall HA in different availability zone in Azure

US_SOC_Analyst — Wed, 23 Jun 2021 18:36:10 GMT

@raji_toor Thank you. Sorry I was mixed up. Yeah, the LB will divert the traffic and a new session will be created anyway when the traffic is sent to a different firewall.

Re: Deploy PA firewall HA in different availability zone in Azure

JimMcGrady — Thu, 24 Jun 2021 00:50:15 GMT

I'm going through the process of moving a vm-series gateway into an availability zone in Azure. Unfortunately there is no simple way to do it. I tried to build a zone capable replacement directly from the Marketplace, but kept getting errors.

The way i have done it (under guidance from MS support) may not be the best way, but it worked.

- You'll want to clone the disk from your existing VM. Before that, you will need to deactivate the Palo Alto license associated with the VM as the new VM will have a different serial. You can activate the license against the new VM later.

To clone the existing VM's disk, navigate to the disk itself in Azure portal. There is an option to 'create snapshot'. You may need to stop the machine first before creating a snapshot. Once the snapshot is done, browse to it in the portal. You then have the option to create a disk from the snapshot. That process will allow you to select an availability zone for the new disk to reside in.

- You may wish to reuse the network interfaces from your original VM. These can be disconnected from that VM once it is stopped. They can later be re-attached to a new VM

- MS talked me through using a bash script within Azure to create a new VM and connect it to the cloned disk. From the bash prompt, make sure you are in the desired subscription first. The script was:

az vm create \

--resource-group existing-rg \

--name myfirewall-AZ2 \

--size Standard_DS3_v2 \

--os-type Linux \

--attach-os-disk myfirewall_OsDisk_1 \

--plan-name byol \

--plan-publisher paloaltonetworks \

--plan-product vmseries1 \

--zone 2 \

--location myazureregion \

--nics myfirewall-eth0

Note that the NIC was detached from the original VM. I expect you can add all 3 of the NICs here. I added the other 2 once the machine was built.

The machine started successfully and had the config of the original machine. I then had to re-apply the licenses/subscriptions.

Re: Deploy PA firewall HA in different availability zone in Azure

SwapnilSonawane — Tue, 06 Sep 2022 13:17:22 GMT

Hello @raji_toor ,

Very interesting that you were able to deploy using Load balancer. Can you please share some document where we can point traffic from load balancer to both the firewalls in different zones.

As the firewall deployment does not give a zone option to deploy

Re: Deploy PA firewall HA in different availability zone in Azure

PradeepKumarMall — Wed, 07 Sep 2022 07:15:33 GMT

Hi JimMcGrady,

can you please help me find the installtion guide for PaloAlto firewalls with Azure Availability Zone.

I tried to find it but no luck.

thanks in advance.

Re: Deploy PA firewall HA in different availability zone in Azure

Gladstone — Tue, 18 Apr 2023 21:28:46 GMT

Anything more recent for deploying into an existing setup? It's frustrating that at this point you can't specify an availability zone via the marketplace deployment.

Re: Deploy PA firewall HA in different availability zone in Azure

JonasVanraes — Thu, 18 Dec 2025 13:15:56 GMT

I have done the switch from two firewalls within an availability set towards availability zone. It's easy to deploy them into an availability zone by using ARM templates. I do think it's strange that Palo Alto is not even referencing the option to use availability zones in their Design guides.