topic Re: Palo Alto 10.0 firewall in HA in Azure in VM-Series in the Public Cloud

Palo Alto 10.0 firewall in HA in Azure

sameer.ahmad — Wed, 22 Sep 2021 06:13:26 GMT

Hi,

We are trying to test VM series firewall in HA without load-balancer and following the documentation listed on PA website, can someone confirm if the document is well tested and we are seeing issues in connectivity and Template for secondary firewall is not clearly identified. Please let me know if there is any working template for HA.

Also I want to use my own public IP from my own organization so is it possible use it or not, please point to any relevant documentation if it supported or not, I heard people advise to use Loadbalancer solution instead standard HA ?Please advise as we would prefer standard HA .

Regards,

Sam

Re: Palo Alto 10.0 firewall in HA in Azure

tostern — Wed, 22 Sep 2021 06:56:43 GMT

Hi @sameer.ahmad

here are the official document from Palo Alto about the configuration of native HA https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure.html

We tested it already several times and it is working but you have to know that failover time is around 3 - 10 minutes because of the API calls on the Azure side. We can't speed up that process.

Our recommendation is always to use Azure Load Balancers, then you get better SLA's and higher resilience.

Regards,

Torsten

Re: Palo Alto 10.0 firewall in HA in Azure

sameer.ahmad — Wed, 22 Sep 2021 13:59:06 GMT

Thanks Tostern, is there a working template for Secondary firewall. Also I see in some documents we need to add route tables in Azure , can you clarify on it ?

Also which permissions we need to add like Secondary HA , UDR or all. If we just add permission using Secondary HA is it sufficient.

Re: Palo Alto 10.0 firewall in HA in Azure

sameer.ahmad — Wed, 22 Sep 2021 14:02:15 GMT

@tostern : Also is there a specific guidelines if we can assign our own public IP instead of Azure IPs to Palo Alto firewall. If we cannot assign it where it is specified in the docs.

Thanks

Re: Palo Alto 10.0 firewall in HA in Azure

sthornton — Thu, 23 Sep 2021 22:08:31 GMT

Sameer:

Here is a community supported template that does HA faster than the normal API method Torsten described. Some customers have tested this and liked it. The design still uses load balancers though so this would only be used in the event that you had a driving reason to run active/passive.

https://github.com/PaloAltoNetworks/azure-terraform-vmseries-fast-ha-failover