topic Re: Interface IP address configuration when firewall in HA active passive in General Topics

Interface IP address configuration when firewall in HA active passive

ismailsh — Thu, 04 May 2023 21:07:47 GMT

Hi,

I have 2 palo alto firewalls configured as active and passive. I want to know how I should configure the Interface IP address (for inside and Dmz) on the passive firewall? Do they have different IP address configured from the active firewall (similar to how we do it on Cisco ASA) ?

Thanks

Re: Interface IP address configuration when firewall in HA active passive

BPry — Thu, 04 May 2023 21:12:09 GMT

@ismailsh,

You don't configure interface addresses on the passive firewall when you have an Active/Passive pair. The configured interface address(es) will only ever be active on the Active firewall. You'd access the Passive firewall by its MGMT port and it's configured IP address.

Re: Interface IP address configuration when firewall in HA active passive

ismailsh — Fri, 05 May 2023 16:15:25 GMT

Hi BPry,

Thank you for your reply. When I tried to remove the IP address from the passive firewall using Panorama config deploy , panorama config deploy errored out. Therefore I put the same IP address that I have on the active Palo Alto onto the passive palo alto. Once I deployed the configuration (with both firewalls having the same inside IP) , I did a failover test and it was successful.

Re: Interface IP address configuration when firewall in HA active passive

Raido_Rattameister — Mon, 08 May 2023 14:59:08 GMT

Active/Passive firewalls should be inside same template in Panorama.

Re: Interface IP address configuration when firewall in HA active passive

aleksandar.astardzhiev — Mon, 08 May 2023 18:41:56 GMT

Hi @ismailsh ,

Fun fact for Panorama managing HA firewalls - Panorama always push the configuration separately to both members when they are in active/passive mode.