topic Re: Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure in VM-Series in the Public Cloud

Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

BilalM — Mon, 20 Feb 2023 17:43:12 GMT

Hi All,

We have 2 Palo Alto VM firewalls (A: Primary & B: Secondary) deployed in Active/Passive mode for high-availability. These firewalls are deployed in Azure cloud and have multiple site to site IPSEC VPN tunnels configured with multiple vendors. Recently, we faced an issue when we were performing PAN OS upgrade on both the firewalls.

After we upgraded secondary firewall B, we failed over the traffic from A to B so that we can upgrade A:Primary one, the failover happened successfully from A to B but the floating IP did not move from A to B. Hence, we had to roll back the changes as external IP remained on suspended firewall A: Primary and VPN tunnels went down which led to outage. So, as a resolution we had to manually attach the floating IP from firewall A to firewall B, which became active after manual failover.

Can someone please help me in below,

1. How can we avoid the situation so that floating Ip moves whenever there is failover triggered between Active & Passive for Palo Alto VM firewalls in Azure?

2. How can we setup monitor for external public IP which is attached to the floating IP in Azure so that we know that VPNs with multiple vendors are up and running fine?

3. What is the best architecture design solution for site to site VPN tunnels setup configured in Palo Alto VMs in Azure?

Thanks & Regards,

Bilal

Re: Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

BilalM — Wed, 22 Feb 2023 08:09:22 GMT

@djr / @SebRupik , can you please help me here, any suggestions?

Re: Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

djr — Wed, 22 Feb 2023 13:56:48 GMT

I'm afraid I can't help with this, I don't have experience of VM Palos in cloud environments, sorry.

Re: Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

BilalM — Tue, 28 Feb 2023 08:31:01 GMT

@reaper , any suggestions for my query.

Re: Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

reaper — Thu, 02 Mar 2023 15:47:20 GMT

for 1. i'd use 2 standalone VMs with loadbalancing instead of a HA cluster

2. there's monitoring tools in azure for that

3. if you go with the standalone VMs you can setup 2 tunnels and use these for failover (pbf/bgp/...)