topic Re: Best approach on connecting two PaloAlto firewalls pairs with different networks in Next-Generation Firewall Discussions

Best approach on connecting two PaloAlto firewalls pairs with different networks

maan2004 — Fri, 20 Sep 2024 08:30:54 GMT

Hello,

I am a newbie in networking, hopefully my explanation is clear, so I do have a pair of PA 3260 running in Active\Passive configuration, with multiple Layer 3 interfaces and sub interfaces connected, each one of those interfaces is a security zone, and routing is handled automatically between the interfaces.

Now I want to connect the PA 3260 pairs to a PA 3020 pair that is also running Active\Passive configuration with different Layer 3 interfaces, similarly each in its security zone and routing done automatically.

my question is what is the best approach to have a connectivity between those two firewalls, and be able to create security policy between individual zones in PA 3260 and PA 3020.

Re: Best approach on connecting two PaloAlto firewalls pairs with different networks

OtakarKlier — Fri, 20 Sep 2024 19:50:36 GMT

Hello,

Are all the PAN's in the same location? What is the difference in traffic that each pair handle? Reason I ask, it might be easier to collapse the 3060 into the 3260 and retire the 3060 pair? I'm a huge fan of keeping things simple.

Regards,

Re: Best approach on connecting two PaloAlto firewalls pairs with different networks

maan2004 — Sat, 21 Sep 2024 10:21:58 GMT

Thanks for your reply, Yes they are on the same room, things were separated as 3060 is handling some kind of operation traffic which has higher priority than the 3260, I guess kind of physical segregation and minimize downtime in hardware failure.