NGFW HA on AWS with different AZ

Amit_Sharma — Mon, 08 Nov 2021 11:39:27 GMT

Hi All,

I want to configure Active/Passive HA on AWS, but both the PA-Instance should be in different AZ. How can we achieve this?

I have referred below article: https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/high-availability-for-vm-series-firewall-on-aws/configure-activepassive-ha-on-aws.html

In the above article it is not mentioned anything about AZ.

Suggest few options to achieve this.

Re: NGFW HA on AWS with different AZ

SutareMayur — Tue, 09 Nov 2021 13:51:31 GMT

Hi @Amit_Sharma ,

The document that you are following has mentioned the prerequisites regarding AWS AZ. It tells -

The HA peers must be deployed in the same AWS availability zone.

Coming to Palo Alto HA configuration on AWS, the VM palo alto supports A/P HA configured within a single AWS AZ. A/P Palo Alto VM HA cannot span multiple Availability Zones due to the AWS limitation of not allowing ENI moves to span AZs. Kindly refer below article -

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClD9CAK

Hope it helps!

topic NGFW HA on AWS with different AZ in VM-Series in the Public Cloud

NGFW HA on AWS with different AZ

Re: NGFW HA on AWS with different AZ