topic Re: Azure NGFW active-active HA and Panorama requirements in VM-Series in the Public Cloud

Azure NGFW active-active HA and Panorama requirements

andrewkelleher — Tue, 08 Sep 2020 12:28:19 GMT

Hi, we're currently evaluating the use of NGFW's for a new Azure deployment.

Ideally, we need to deploy NGFW in an active-active HA pattern behind an Azure internal load balancer.

The documentation appears to state that Panorama is required to support this configuration. Is this a hard requirement? Is it possible to enable active-active with Config sync without Panorama?

Thanks.

Re: Azure NGFW active-active HA and Panorama requirements

tostern — Wed, 09 Sep 2020 14:22:25 GMT

Hi Andrew,

we talking here about two different things. the documentation is talking about Azure Autoscaling no we didnt use here a native HA configuration both firewalls are working independently. the is no Session Sync. the Panorama is taking care here about the increase and decrease of VM-Instances inside the VMSS and this is done via the AppInsight Metrics.

the Native HA configuration is working in Azure but without a Loabbalancer in the Front or Back. look here about the Setup https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure.html

I hope that helped you?

Regards,

Torsten

Re: Azure NGFW active-active HA and Panorama requirements

JoergSchuetter — Wed, 09 Sep 2020 14:53:27 GMT

Hello

We have configured HA on Azure, but it turns out that is not the best setup. You don't need a loadbalancer (and therefore no additional virtual router if you have more than one interface behind a loadbalancer).

Unfortunately the failover (regardless of triggered manual or due to an failure) is very slow. The command "hey Azure, shift IP from from interface A to interface B" is triggered immediately. In our environment (trusted, untrusted + two additional IPs with public IP) it typically takes 3 up to 5 Minutes until the failover is completed.

Re: Azure NGFW active-active HA and Panorama requirements

tostern — Wed, 09 Sep 2020 15:10:21 GMT

Hi Jörg,

thats correct and thats a normal behaviour in Azure. The Problem here is the API call from Azure to detach and attach the interface.

Regards,

Torsten