topic Re: HA GlobalProtect firewalls in Azure in VM-Series in the Public Cloud

HA GlobalProtect firewalls in Azure

bxbukows — Fri, 12 Dec 2025 10:19:31 GMT

I would like to deploy GP firewalls in Azure, I would like to configure 2 firewalls which are working active-active to have always some protection if one availability zone will have maintenance always second fw will handle the traffic. I was think to have 2 portals and 2 gateways, on 2 different Public IP which will be resolved on one DNS name. Did some one have similar configuration on Azure and deployed 2 Global Protect firewalls ? Or other solution which will cover HA in Azure for GP ?

Re: HA GlobalProtect firewalls in Azure

BorislavP — Fri, 12 Dec 2025 15:05:16 GMT

Trying Active/Active HA in Azure for VM-Series — not the supported cloud pattern. Use A/P HA:

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/about-the-vm-series-firewall-on-azure/support-for-high-availability-on-vm-series-azure

Re: HA GlobalProtect firewalls in Azure

bxbukows — Fri, 12 Dec 2025 15:30:07 GMT

Thanks BorislavP for your comment, A/P HA in Azure could take 3min to failover. I would like to setup 2 firewalls without additional interface for HA as on premises/hardware appliances. This will be regular Azure deployment with 2 firewalls and 3 interfaces, public , private and mgmt.

https://www.paloaltonetworks.com/resources/guides/azure-transit-vnet-deployment-guide

But cannot find any guide for GP firewalls in Azure

Re: HA GlobalProtect firewalls in Azure

BorislavP — Fri, 12 Dec 2025 16:03:40 GMT

Even though there is no single guide, this design is fully covered by the following official Palo Alto Networks documents:

VM-Series on Azure (deployment only)

Set Up the VM-Series Firewall on Azure

https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure

GlobalProtect – Multiple Gateways (this is the “HA guide”)

Configure Multiple GlobalProtect Gateways
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-quick-configs/globalprotect-multiple-gateway-configuration

GlobalProtect Architecture overview
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-architecture

About GlobalProtect Gateways and Portals
https://docs.paloaltonetworks.com/globalprotect

Re: HA GlobalProtect firewalls in Azure

PavelK — Sat, 13 Dec 2025 21:33:37 GMT

Hello @bxbukows

similar topic came up in this thread: GlobalProtect Design Question. In nutshell you can solve this active / active scenario by building 2 VM Firewalls with all GP setting and let Azure Traffic Manager to distribute the load to each of the VM based on Traffic Manager's traffic routing method: Traffic Manager routing methods.

Kind Regards

Pavel

Re: HA GlobalProtect firewalls in Azure

bxbukows — Tue, 16 Dec 2025 08:50:43 GMT

Thx PavelK, with this configuration both firewalls will have configuration GP gateway and Portal, I know on premise solution with one GP Portal and many GP Gateways. Not sure how to build 2 GP Portals, because I would like to have one Portal DNS name gp.company.com, when there will be 2 GP Portals not sure if there will be 2 different names, user need to configure on GP app Portal name, so it could be situation one Portal will be most occupied and second will be almost free?

Re: HA GlobalProtect firewalls in Azure

rswarnkar — Thu, 18 Dec 2025 05:30:39 GMT

Nebiw here. But Isn't the PA Global Protect kind of RAS or VPN, instead of Firewall? I thought GP was kind of device for VPN Gateway/Express Route, and PA VMSeries equivalent to azure firewall in Auzre landscape.

Re: HA GlobalProtect firewalls in Azure

PavelK — Mon, 22 Dec 2025 23:57:36 GMT

Hello @bxbukows

thank you for reply.

The way how I would design it is to create a DNS CNAME used by GP Client pointing to DNS of Azure Traffic Manager. The Azure Traffic Manager will have both DNS A records of GP Portal configured as a target. You can set in the Azure Traffic Manager load balancing ration 50/50 between each of the GP Portal. In this way both GP Portals can be used by using a single DNS record in GP Client.

gp.company.com
↓
Azure Traffic Manager
↓
GP Portal A / GP Portal B

I have used this approach in the past with thousands of VPN users daily. The only difference the VPN appliance was not PA with Global Protect.

Kind Regards

Pavel