New Internet connection - break up HA pair to provision?

HHRINetwork — Fri, 07 Aug 2026 17:49:42 GMT

We have a pair of PA440s as our main firewall, with a fairly complex but not totally weird configuration - all physical interfaces in use, some with sub-interfaces, NAT to some inbound servers, VPN, URL filtering, etc etc.

We have a new Internet connection - same provider, but with upgraded service that precluded just turning up the speed. It's a different physical line to different vendor equipment, with a new external IP range.

I'm thinking about how I would test and implement this, and here's what I think:

- disable HA so that both PA440s are now standalone - with the same configuration as each other, right?

- keep A on the old connection, leave all connections the same

- patch B's Internet interface into the new connection, and shutdown everything else except mgmt

- reconfigure B for the new IP range, and a different IP from my main range on the internal trusted interface

So then, I could test by shutting down A and bringing up interfaces on B (and changing internal routing as needed) and at least see that outbound-only traffic was behaving, right?

And then, update public DNS to reflect the changed external range and make sure I didn't typo the NAT policies.

Obviously, this is high-level overview. But - am I insane to think this will work (for instance, will the passive of the HA pair have a usable config on it, or will it revert to something else)?

topic New Internet connection - break up HA pair to provision? in General Topics

New Internet connection - break up HA pair to provision?