Active-Active" mode HA setup across different locations.

BrajeshPatel — Sun, 09 Apr 2023 04:05:12 GMT

Hi Team,

Greetings,

We have a requirement like client want to know about the FW HA across different location in "Active-Active" mode.

For example, PA Model: PA-3430

What are requirements for having fw cluster spread across different GEO locations (latency, delay, etc)? Distance between two locations is 5-10 KM.

Is this recommended at all by PA? If yes, what kind of link is required for HA connectivity (L3, L2) for "Active-Active"?

I guess Client may consider Multi-VSYS environment too.

Would it possible to make this happen? Please share your thoughts.

Thank You

Re: Active-Active" mode HA setup across different locations.

TomYoung — Sun, 09 Apr 2023 19:58:59 GMT

Hi @BrajeshPatel ,

Yes, it has been done many times as long as the latency is fine. PANW unofficially recommends 20ms or better between firewalls. Customers have reported it works fine with 80-120ms. Check out this video starting at 1 hour 14 minutes. Bandwidth should also be considered. https://www.youtube.com/watch?v=4hFQypgOAGk&t=4665s

Thanks,

Tom

topic Active-Active" mode HA setup across different locations. in General Topics

Active-Active" mode HA setup across different locations.

Re: Active-Active" mode HA setup across different locations.