https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/ha-fw-on-aws/m-p/1260075#M2470 <P>I want to deploy two firewalls on AWS, in different availability zones. I understand from the guide that this isn't recommended, but that it is supported. I've managed to complete the deployment without any issues.</P> <P>However, I have some questions. Since it’s not possible to move an ENI between AZs, if there’s a failure with FW-A or AZ-A, FW-B will be active, but traffic will still be routed to A. How can I resolve this issue?</P> <P>The reason for this architecture is that I want session synchronization, and I want both firewalls to synchronize without needing Panorama.</P> <P>Is there a guide that can help me resolve this issue?</P> Mon, 27 Jul 2026 22:26:08 GMT D.Villanueva403262 2026-07-27T22:26:08Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/ha-fw-on-aws/m-p/1260075#M2470 <P>I want to deploy two firewalls on AWS, in different availability zones. I understand from the guide that this isn't recommended, but that it is supported. I've managed to complete the deployment without any issues.</P> <P>However, I have some questions. Since it’s not possible to move an ENI between AZs, if there’s a failure with FW-A or AZ-A, FW-B will be active, but traffic will still be routed to A. How can I resolve this issue?</P> <P>The reason for this architecture is that I want session synchronization, and I want both firewalls to synchronize without needing Panorama.</P> <P>Is there a guide that can help me resolve this issue?</P> Mon, 27 Jul 2026 22:26:08 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/ha-fw-on-aws/m-p/1260075#M2470 D.Villanueva403262 2026-07-27T22:26:08Z