Active Passive Failover in AWS

haider.rangwala — Wed, 20 May 2026 05:26:44 GMT

Hello Guys,

I am trying to configure Active-Passive (A/P) HA failover for Palo Alto VM-Series firewalls in AWS.

I have completed the HA configuration and updated the required IAM roles and permissions. Currently, the setup is partially working as expected:

Primary Public IP (EIP) successfully moves from Passive ENI to Active ENI during failover.
Route tables are also getting updated correctly after failover.
Traffic connectivity is working fine after failover.

However, I am facing an issue when using multiple UNTRUST interfaces.

Scenario:

I created additional UNTRUST NICs/ENIs.
Assigned separate Public IPs/EIPs to those ENIs for hosting different applications/services.
During failover, only the first UNTRUST interface Public IP moves to the Active firewall.
The additional UNTRUST ENI Public IPs are not moving to the Active instance.

Requirement:
I need multiple UNTRUST NICs, each with its own Public IP/EIP, and all those EIPs should fail over automatically to the Active firewall during HA failover.

Current Environment:

PAN-OS Version: 12.1.4-h5
AWS Plugin Version: 6.1.2-h1

Has anyone implemented a similar design or faced this issue before? Any guidance or recommended configuration changes would be greatly appreciated.

Thank you in advance for your support.

topic Active Passive Failover in AWS in VM-Series in the Public Cloud

Active Passive Failover in AWS