Prisma Access Service Connection to Palo Alto FW in HA-AA

IBalaro — Wed, 25 Feb 2026 00:40:43 GMT

Hi,

We were able to make the tunnels up under 1 Service Connection (with 2 tunnels, primary and secondary) in Prisma Access and 2 tunnels in Palo Alto FW with Active-Active HA setup. If both tunnels are up, loopback IP in FW1 is accessible from GP user. But when the primary went down and secondary tunnel is still up, GP user in unable to reach/access the loopback IP of FW2. What would be the reason of this? Did we make the correct setup with regards to the tunnel? Appreciate your inputs. Thanks.

Re: Prisma Access Service Connection to Palo Alto FW in HA-AA

reaper — Thu, 26 Feb 2026 12:01:14 GMT

Hi!

did you set up tunnel mon itoring? that actively helps to disable rouytes when a tunnel goes down

ideally use BGP instead of static routes as well (but tunnel monitor should help you out in this)

topic Prisma Access Service Connection to Palo Alto FW in HA-AA in Prisma Access Discussions

Prisma Access Service Connection to Palo Alto FW in HA-AA

Re: Prisma Access Service Connection to Palo Alto FW in HA-AA