topic Do I need an edge router in front of my Palo Alto? in General Topics

Do I need an edge router in front of my Palo Alto?

M.Gannon — Thu, 22 Jan 2026 17:21:25 GMT

having a general discussion about architecture with a colleague and after thoughts from a wider audience.

By deploying my Palo Alto in an Active/Active pair I can connect my firewalls directly to the ISP/MSP and use BGP to control route traffic.

My colleagues suggestion was it still needs the CE router where you can apply a simple zone based firewall/ACL on the router to limit the scope of traffic hitting our firewall. But I don't see any benefit in this. You can use Active/Active to overcome the limitation of needing FHRP for failover.

I was just wondering on other peoples thoughts.

Re: Do I need an edge router in front of my Palo Alto?

Raido_Rattameister — Thu, 22 Jan 2026 17:27:41 GMT

Depends if ISP advertises full Internet routing table or only default route (and maybe routes originating from their AS).

Re: Do I need an edge router in front of my Palo Alto?

OtakarKlier — Fri, 23 Jan 2026 19:32:07 GMT

Hello,

My thoughts on modern design is you dont. But I'm sure there are special cases where you might.

Regards,