topic Re: PA-850 High Availability Cabling in General Topics

PA-850 High Availability Cabling

GajananDixit — Mon, 03 Apr 2023 06:40:42 GMT

Can we separate the PA-850 two of HA boxes using Fiber to Copper Media Convertor in case I want to keep both boxes in different buildings to achieve HA ( our boxes are in Active-Passive mode ) ?

Current configuration of HA is on Copper Ports.

Re: PA-850 High Availability Cabling

TomYoung — Mon, 03 Apr 2023 09:42:11 GMT

Hi @GajananDixit ,

Yes, it can be done. Check out this discussion -> https://live.paloaltonetworks.com/t5/general-topics/high-availability-for-firewalls-in-diferent-locations-over-layer/m-p/427970#M94656.

You can use IP addresses for your HA2 links so they can route across your network. In that scenario, PANW recommends encrypting the traffic.

Thanks,

Tom

Re: PA-850 High Availability Cabling

BPry — Mon, 03 Apr 2023 17:42:51 GMT

@GajananDixit,

If you're going to use a media converter the only thing I would really caution is using cheap devices for these links. I'd recommend spending the money for a managed unit so that you can monitor for faults outside of the interface just failing.