Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites

jrcsss — Wed, 07 May 2025 22:34:47 GMT

Is it possible to extend a VLAN across two pairs of Palo Alto Networks firewalls in an HA (active-passive) configuration located at two different sites (Site A and Site B), while allowing each HA pair to use the same virtual IP address range?

What are the standards and protocols that support this architecture with Palo Alto Networks firewalls? We try this but in simulation only manage gateway .1 for site A and gateway .2 for site B, don't found how made a virtual IP inter sites

Simulation:

vlan 100 gw.1 (FWs Active - FW Passive) Site A -----------layer 2-----------vlan 100 gw.2 (FWs Active - FW Passive) Site B

Re: Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites

ozheng — Thu, 15 May 2025 04:00:37 GMT

Hello @jrcsss ,

Assuming you are trying to make some HA across multiple site (1 site down failover to the other site), you should check that link to Public documentation (layer 2 is not supported).

Olivier

topic Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites in Next-Generation Firewall Discussions

Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites

Re: Vlan extend layer 2 - Pair of firewalls HA (Active passive) in differents Sites