topic Re: HA active/active dual ISP load balancing in General Topics

HA active/active dual ISP load balancing

nw-rogox — Thu, 31 Aug 2023 04:28:13 GMT

Hi all,

I am considering network design that have:

- Dual ISP (public IP /29 for each)

- 2 x PA with active/active HA

- PA connects directly to L2 networks (LAN)

Requires:

Load sharing between 2 ISP Internet links

Problems:

Is it possible to configure separated nat for each?

How session can failover to remaining PA? Do I need Floating IP for WAN public?

Re: HA active/active dual ISP load balancing

TomYoung — Thu, 31 Aug 2023 12:49:38 GMT

Hi @nw-rogox ,

I would configure active/passive HA. It is less complex than active/active.

You can create 2 VLANs on your existing switches - one for each ISP. (As long as you do not create a L3 IP address for the VLANs, the switches will not be accessible from the Internet.)
Then you can connect each ISP to both NGFWs and use active/passive HA.
Enable ECMP with Symmetric Return.
Configure 2 default routes.
Configure NAT normally for each ISP.
You can tune the ECMP hashing if you have weird issues. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/ecmp/ecmp-load-balancing-algorithms

Thanks,

Tom

Re: HA active/active dual ISP load balancing

nw-rogox — Fri, 01 Sep 2023 09:38:14 GMT

Hi Tom,

Much appreciated your support.

As your idea, I need to add 1 physical uplink connection for each PA, but from ISP to PA Firewall, they provide the single RJ45 port via MediaConverter, not switches. However, I am consider to expand the connections as your idea.

One thing that, if I use active/active mode, I can leverage the both firewall resources same time, could you give some document or ideas to establish active/active HA with both firewall facing Internet with public IP?

I tried and in ActiveActive mode, it require NAT to the Floating IP, not accept the interface's IP as usual.

Re: HA active/active dual ISP load balancing

TomYoung — Fri, 01 Sep 2023 12:33:55 GMT

Hi @nw-rogox ,

Active/active does give you the advantage of doubling your NGFW throughput. However, in a failure scenario the throughput is cut in half which may not be desirable. The additional complexity of active/active is generally not recommended. Designs that are too complex tend to not only be a pain to configure as you are feeling now, but they also tend to be a pain to maintain, i.e., new problems may come up in the future.

For example, you cannot use a floating IP address in NAT unless you have a common BGP public IP across both ISPs.

I do not know of any documents to help you. I did do a quick Google search and saw a couple videos you may look at. They both used the switch to connect the dual ISPs to both NGFWs.

Sorry! That is all I have.

Thanks,

Tom

Re: HA active/active dual ISP load balancing

B.Bagheri — Fri, 06 Jun 2025 15:11:52 GMT

One note, ECMP is only available for some hardware models.