topic Re: HA-Palo Alto with 2-Diffrent ISP in General Topics

HA-Palo Alto with 2-Diffrent ISP

Nibrass93 — Tue, 14 Jan 2025 06:17:23 GMT

Dear Community

i have 2-PA configured as HA and need to be redundant for ISP,so i have interface from ISP-A and another one from ISP-B, and from internal service i have VM server that needs only one IP statically work with NAT and 2-Vsys,and using static route for routing, my question is how I can make some change so I can make redundant for the Uplink side and make failover when ISP-A down , all service go through ISP-B ,

Re: HA-Palo Alto with 2-Diffrent ISP

BPry — Tue, 14 Jan 2025 22:55:53 GMT

@Nibrass93,

To start with, you'll want to configure ISP redundancy. Start with https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLL8CAO and that will get that step out of the way.

For the server, that really depends on what the server itself is doing. There's a lot of ways that you can easily accomplish this but it varies a bit depending on what your server is actually hosting.

Re: HA-Palo Alto with 2-Diffrent ISP

Nibrass93 — Wed, 15 Jan 2025 12:32:42 GMT

thanks for reply

in my case i have already 2-Vsys and 2-Zone and each of them has the uplink and internal service different from another second Vsys,so here I am asking when i need to make these uplink's merage and shared as redundant for all Vsys i have in my environment how can make this because when asgin interface for Vsys it can't seen or shared to another Vsys ,so can keep Vsys without change for internal service and only shared the uplinks

Re: HA-Palo Alto with 2-Diffrent ISP

Nibrass93 — Wed, 15 Jan 2025 12:43:14 GMT

thanks for reply,

in my case i have 2-Vsys and each Vsys is isolated to another with his service zone and NAT and security rules and uplink, my question here is when I need to keep this service isolated and shared only between uplinks and make it as redundant uplinks so when uplink of Vsys1 has down it can make traffic routed to the uplink for Vsys2 normally and vise versa,