topic Re: Custom script to sync 1 firewall to another. HA in Automation/API Discussions

Custom script to sync 1 firewall to another. HA

APatel — Tue, 18 Nov 2014 03:31:35 GMT

Here is my scenario. Main site, 3020 HA pair. DR site single 3020. Sites are geographically separated, different ISP's, different certificates.

My plan is to stand up and configure interfaces, certificates, VPN, and other unique elements. What will be the same is zones, objects, services,policies, etc.

What I am wondering is if there is a script that can be written to keep the zones, objects, services, policies, etc in the main firewall sync to the DR firewall. Essentially I am trying to make a type of HA. with 2 passive devices.

Thanks for the help!

Re: Custom script to sync 1 firewall to another. HA

cpainchaud — Tue, 18 Nov 2014 17:37:10 GMT

Hi,

Wouldn't Panorama work in your case ? What you describe seems to be the perfect example for Device Groups.

Re: Custom script to sync 1 firewall to another. HA

cpainchaud — Tue, 18 Nov 2014 17:46:26 GMT

anyway what you describe is possible.

our configs is XML, you would just replicate entire objects & rules xml trees from one to the other , but the script would trigger manually (you launch it) unless you come with a log monitor system (like a syslog running somewhereà that listens for commit logs to trigger synchro script.