topic Re: Firewall - Interface High availablity in General Topics

Firewall - Interface High availablity

gpsriram — Thu, 29 Nov 2018 08:08:57 GMT

Hi All,

In my scenario, i have single PA-220 for guest access. In trusted zone i would like to keep the interface lelvel (active/standby) high availablity.Interface type as L2. I couldn't do aggregate interface since it's connected to two seperate switches.

How we can achieve this.??

Thanks in Advance..

Re: Firewall - Interface High availablity

Raido_Rattameister — Thu, 29 Nov 2018 14:21:34 GMT

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches 🙂

Re: Firewall - Interface High availablity

Brandon_Wertz — Thu, 29 Nov 2018 14:41:49 GMT

@Raido_Rattameister wrote:
You could set up Palo interfaces in Layer 2 mode.
But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches 🙂

I did this exact setup for a 220 HA pair. With a 3750 stack. I actually ended up using port-channels though on the internal and external interfaces. This got me device redundancy on both the firewall and switch side.

But like @Raido_Rattameister mentioned. an access vlan config to each switch should work just fine.