topic Re: 3 node cluster or HA in Next-Generation Firewall Discussions

3 node cluster or HA

M.Sridharan — Thu, 30 Jul 2026 10:19:31 GMT

Hi community.

I am setting up a palo alto firewalls for a customer and they need it as 3 nodes. they are going to be placed in three different buidling inside the same campus.

I have gone through the documents and seeing that clustering is the only option as it is 3 in number.

I want to know is there any way that i can make this into HA of 3 nodes with their HA1 and HA2 being switched using LAyer 2 extensions across these buildings.

Also if i want to form a cluster, only session synchronisation is achieved via HA4 links, won't the config and control plane activities wont be synced across the cluster members via the Group master ?

OR config sync for cluster can be achieved only via panorama deployment ?

Kindly shed some light on this to get me decide things up.

Thanks in advance

Re: 3 node cluster or HA

BPry — Thu, 30 Jul 2026 14:03:06 GMT

@M.Sridharan,

I'm confused by the business requirements here. Why do you need three firewalls simply because you have three buildings across your campus? What's the rationale there?

Re: 3 node cluster or HA

M.Sridharan — Thu, 30 Jul 2026 14:10:42 GMT

Its the ask from the client that they need to have higher redundancy

Re: 3 node cluster or HA

BPry — Thu, 30 Jul 2026 14:58:27 GMT

@M.Sridharan,

Unless this environment has multiple active DCs in each building, or an actual active/standby DC, this rarely actually makes sense. I don't know what type of environment you're working with here, but it's just pretty abnormal that someone with this sort of setup would be outsourcing its configuration to someone who hasn't set it up before. You'll also have limited hardware options that actually support this, so there's quite a lot of groundwork to do to verify that this actually makes sense for the client and they're prepared for the cost of what they're asking for.

I would highly recommend reading up on clustering and the limitations that it brings, alongside asking a ton of environment questions to verify that it is the right choice. Depending on the environment, introducing it properly and actually accomplishing increased redundancy can mean introducing a lot more changes than just the firewall topology.

As for your actual questions:

I want to know is there any way that i can make this into HA of 3 nodes with their HA1 and HA2 being switched using LAyer 2 extensions across these buildings.

This is not at all how clustering works. Toss HA1 and HA2 out of your mind in a cluster, they are only relevant if you are making a cluster out of HA pairs.

As far as configuration goes, it's assumed that you are going to be using Panorama to keep things in sync. You can do it standalone if you have templating and automation in place to mirror things, but outside of Panorama or SCM you will need to ensure that the firewalls are actually sharing the required configuration manually.

OR config sync for cluster can be achieved only via panorama deployment ?

You do not need to use Panorama for a cluster, but it is highly recommended and would be the 'standard' way to manage things. You can absolutely do it standalone, but you're going to want to have templating and automation already in place to ensure that the configuration between cluster members are actually in-sync.