https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/more-info-on-ha-in-azure/m-p/312991#M770 <P>The documentation seems a bit light on detail. I have created a Service Principle in Azure and entered the data into my two firewalls as per these documents:</P><P><A href="https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure" target="_blank">https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure</A></P><P><A href="https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal" target="_blank">https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal</A></P><P>&nbsp;</P><P>The firewalls validate successfully. However, during failover, the secondary IP addresses dont move.</P><P>Should there be some config on the firewalls to say "move secondary IP addresses of interfaces A, B, C, and move public IP"?</P><P>Would there be corresponding config within Azure? How does the system know which interfaces need their addressing changed?</P> Wed, 26 Feb 2020 08:08:45 GMT JimMcGrady 2020-02-26T08:08:45Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/more-info-on-ha-in-azure/m-p/312991#M770 <P>The documentation seems a bit light on detail. I have created a Service Principle in Azure and entered the data into my two firewalls as per these documents:</P><P><A href="https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure" target="_blank">https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure</A></P><P><A href="https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal" target="_blank">https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal</A></P><P>&nbsp;</P><P>The firewalls validate successfully. However, during failover, the secondary IP addresses dont move.</P><P>Should there be some config on the firewalls to say "move secondary IP addresses of interfaces A, B, C, and move public IP"?</P><P>Would there be corresponding config within Azure? How does the system know which interfaces need their addressing changed?</P> Wed, 26 Feb 2020 08:08:45 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/more-info-on-ha-in-azure/m-p/312991#M770 JimMcGrady 2020-02-26T08:08:45Z https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/more-info-on-ha-in-azure/m-p/313054#M771 <P>Hey&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/37508">@JimMcGrady</a>&nbsp;,</P><P>&nbsp;</P><P>When doing a firewall failover, how long are you waiting between checking interface IPs? The reason for this is because using the Plugin for failover can take a few minutes. The recommended method to deploy VM series for high-availability in Azure is with two VM series deployed into two availability sets that sit in a load balancer sandwich.</P><P>&nbsp;</P><P>Thanks,</P><P>Luke.</P> Wed, 26 Feb 2020 11:59:24 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/more-info-on-ha-in-azure/m-p/313054#M771 LukeBullimore 2020-02-26T11:59:24Z