https://live.paloaltonetworks.com/t5/next-generation-firewall/ha-path-group/m-p/580624#M2838 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1182974307">@BlackWater</a>,</P> <P>Slightly confused on what your question is? What's the goal?</P> <P>&nbsp;</P> <P>Path monitoring simply uses ICMP to the specified path group to ensure that your active device can actually pass traffic. So just going off of your network design you might create a path group with a failure condition of 'all' and specify the switches and the ISP equipment as destinations and trigger a failure if all of those start failing ICMP. You might have another group that simply checks the ISP gateways are reachable and fail over if all of them are down. It honestly depends on what you&nbsp;<EM>can&nbsp;</EM>monitor and what your desired outcome actually is.&nbsp;</P> Fri, 15 Mar 2024 21:36:19 GMT BPry 2024-03-15T21:36:19Z https://live.paloaltonetworks.com/t5/next-generation-firewall/ha-path-group/m-p/580623#M2837 <P>&nbsp;</P> <P>I am trying to setup HA path group but as seen below between FW and ISP we have L2 switches. what is the optimum solution for path monitoring since L2 switch hardly goes down ? By the way Panorama manages the FW&nbsp;&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="EOdeh_1-1710534820057.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/58427iB6A4871DC907C050/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="EOdeh_1-1710534820057.png" alt="EOdeh_1-1710534820057.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 15 Mar 2024 21:26:12 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/ha-path-group/m-p/580623#M2837 BlackWater 2024-03-15T21:26:12Z https://live.paloaltonetworks.com/t5/next-generation-firewall/ha-path-group/m-p/580624#M2838 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1182974307">@BlackWater</a>,</P> <P>Slightly confused on what your question is? What's the goal?</P> <P>&nbsp;</P> <P>Path monitoring simply uses ICMP to the specified path group to ensure that your active device can actually pass traffic. So just going off of your network design you might create a path group with a failure condition of 'all' and specify the switches and the ISP equipment as destinations and trigger a failure if all of those start failing ICMP. You might have another group that simply checks the ISP gateways are reachable and fail over if all of them are down. It honestly depends on what you&nbsp;<EM>can&nbsp;</EM>monitor and what your desired outcome actually is.&nbsp;</P> Fri, 15 Mar 2024 21:36:19 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/ha-path-group/m-p/580624#M2838 BPry 2024-03-15T21:36:19Z