topic Re: Lab initial procedure for PA VM 8.0 in Next-Generation Firewall Discussions

Lab initial procedure for PA VM 8.0

soorajpmenon5 — Sun, 14 Jan 2024 13:12:06 GMT

Hello Team,

First of all am a noob on the paloalto and I'm diving into the Palo Alto Firewall world after spending a year on the Cisco L2 side. Just set up a lab mirroring the site design for a new organization, and it's my first go at Palo Alto. For the real deal, I'll be handling a PA-850. Feeling pretty good about Nexus and endpoints, but could use some suggestions from the Palo Alto pros. Any suggestions or tips to nail this lab and smooth sail through the site deployment (what steps should i take on the palo alto Firewall) would be awesome. Thanks a bunch for any insights!

Once more, I'd really appreciate any assistance you can offer for step-up the LAB. Thanks a bunch!

Thanks,

Punkn

Re: Lab initial procedure for PA VM 8.0

Raido_Rattameister — Sun, 14 Jan 2024 19:02:55 GMT

I suggest to put switch between ISPs and Palo so that both Palos see both ISPs.

This allows to start with active/passive configuration.

Active/active will add quite a few more configuration settings that need to be set and adds unnecessary complexity. Specially if you just start with Palos.

Re: Lab initial procedure for PA VM 8.0

soorajpmenon5 — Sun, 14 Jan 2024 21:26:52 GMT

Hello Raido,

Absolutely, thanks for the suggestion, and I've already shared it with my buddy. Is it possible set up the PA cluster HA in an active/passive configuration for my new setup?. Also, I want to ensure that the LACP setup I mentioned in the new setup should function smoothly ??, considering my Nexus setup is in vPC ?.

Thanks,

Punkn

Re: Lab initial procedure for PA VM 8.0

Raido_Rattameister — Sun, 14 Jan 2024 22:04:52 GMT

You can have links to separate switches in same LACP bundle in Palo only if both peers (both Nexus switches) advertise themselves with same LACP ID.