Shared IP in the WAN Side with HA Active/Active and ARP Load Sharing

rmeddane — Mon, 25 Dec 2023 22:01:41 GMT

Can we confgure the Shared IP in the WAN side in HA Active/Active?

Because I read in the PAN OS Admin guide two things:

Page 410: As illustrated in the floating IP address scenario, the firewall supports a shared IP address
for ARP load-sharing only on the LAN side of the firewall; the shared IP address cannot be
on the WAN side.

In the same Guide, page 449:

Use Case: Configure Active/Active HA for ARP Load-Sharing with Destination NAT
This Layer 3 interface example uses NAT in Active/Active HA Mode and ARP Load-Sharing
with destination NAT. Both HA firewalls respond to an ARP request for the destination NAT
address with the ingress interface MAC address. Destination NAT translates the public, shared
IP address (in this example, 10.1.1.200) to the private IP address of the server (in this example,
192.168.2.200).

The configuration of this use case shown that on the WAN Side, a Shared IP or a Virtual Address is configured.

My question, is there any contradiction or something I misunderstood?

topic Shared IP in the WAN Side with HA Active/Active and ARP Load Sharing in Next-Generation Firewall Discussions

Shared IP in the WAN Side with HA Active/Active and ARP Load Sharing