topic Re: Active - Active firewall deployment across two data centers in General Topics

Active - Active firewall deployment across two data centers

MGRashmi — Fri, 22 May 2020 16:23:14 GMT

Hi All,

We are exploring the firewall deployment options for one of our customers who have a requirement to stretch few VLANs across 2 data centers most probably using VXLAN/EVPN. The options currently being explored are:

1. Active-Standby firewalls in each data center

2. Active-Active firewall with one node in each data center

Are there any design/deployment references for these scenarios especially how to avoid double firewalling and the possible scenarios for asymmetric routing and how to avoid them.

Re: Active - Active firewall deployment across two data centers

reaper — Sun, 24 May 2020 21:17:58 GMT

you can avoid asymmetric routing by not deploying in Active/Active 😉

do both datacenters need to be 'hot' or is there one warm standby? do both need active connections to the outside and will the bandwidth needed exceed the VXLAN/EVPN capability?

I'd try to void A/A as that complicates your configuration tremendously with very little ROI (you'll also need to enable HA3 and make sure jumbo frames are supported over the VXLAN/EVPN etc)

Re: Active - Active firewall deployment across two data centers

MGRashmi — Mon, 25 May 2020 11:07:04 GMT

Hi,

Thanks for your response.

Both datacenters need to be "Hot" and will have active connections outside. The bandwidth will not exceed VXLAN/EVPN. I am trying to understand if there are any deployment guides/design options for deploying A/A across data centers in Palo Alto.

Re: Active - Active firewall deployment across two data centers

RSumalal — Thu, 19 Feb 2026 07:27:01 GMT

Which is recommended design of PaloAlto firewalls in active-active datacenters with VXLAN/EVPN switch fabric with anycast gateway? Does it support an active active with network and compute in active-active with stretched VXLAN fabric underlay between the two datacenters?

Re: Active - Active firewall deployment across two data centers

OtakarKlier — Thu, 19 Feb 2026 18:12:57 GMT

Hello,

You might want to reach out to your sales engineer to see if they have any ideas.

Regards,