topic Re: Prisma SD-WAN - ION HA or Cold Spare? in Prisma SD-WAN Discussions

Prisma SD-WAN - ION HA or Cold Spare?

shawnmuas — Fri, 01 Mar 2024 16:20:59 GMT

Looking at what others are doing for Prisma SD-WAN branch redundancy. We've narrowed it down to setting up IONs in HA or leaving a cold spare ION on site for disaster recovery. HA requires double licensing, which is pricey. Cold spare IONs don't require active licenses but the sites will experience longer downtime. IONs are easy enough to reconfigure with the included console cable and a laptop on a hotspot. The benefit of the cold spare is that the device will not be impacted by any power events, which Palo is saying is the problem with multiple ION2k outages we've experienced. The IONs are behind Eaton UPS but the WAN interfaces are not surge protected.

Just getting ideas. Thanks in advance.

Re: Prisma SD-WAN - ION HA or Cold Spare?

jpomachagua — Fri, 22 Mar 2024 15:57:56 GMT

Hello @shawnmuas

I would recommend assessing the criticality of the branch locations and the potential impact of the downtime. If downtime could significantly impact operations or create customer dissatisfaction, setting up IONs in high availability (HA) might be worth the investment, despite the associated licensing costs. On the other hand, if the branches can withstand longer downtime, leveraging a cold spare ION for disaster recovery could be a viable approach.

Ultimately, the choice should align with the organization's risk tolerance, operational requirements, and budget constraints.

Regards

Re: Prisma SD-WAN - ION HA or Cold Spare?

BrewCity34 — Tue, 02 Apr 2024 15:50:15 GMT

I would agree with Jorge's comments. We do run our ION's in HA. For us, we wanted quick recovery for an outage and this was our design prior to SD-WAN. Prior to SD-WAN, we had multiple MPLS circuits at a branch and each circuit terminated to its own router.