Panorama and active/active configurations

mvdven — Fri, 08 Mar 2019 08:06:49 GMT

Hi,

Recently, we added more PA devices to our infrastructure and we decided to start using Panorma to manage all these devices.

So far, we haven't experienced an improvement in efficiency or user/admin friendliness.

Let me (try to) explain:

We have two firewalls who are configured as an active/active setup. (No panorma yet).

These firewalls had to use different virtual router configuration so that part could not be synced.

Whenever we needed to add policies, we could perform this on one node and let commit do the replication as well.

Now, with Panorma added, things apparantly have changed but, the way I see it, not necessarily for the better.

Changes now need to happen at the Panorama (makes sense), but because of earlier mentioned virtual router situation these firewalls cannot be added together in a device group or so I'm told.

And this means whenever a (policy) change needs to be implemented it needs to be done seperately on both firewalls through seperate push and commits?

Please help me understand this better, or explain what can be improved in this situation. To configure Panorama to help us more instead of creating more work.

Re: Panorama and active/active configurations

reaper — Fri, 15 Mar 2019 12:57:05 GMT

You want to look into using template stacks

This allows for 2 or more firewalls to have certain shared and certain not-shared config bits to still happily coexist in a single device group

https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/templates-and-template-stacks

topic Panorama and active/active configurations in General Topics

Panorama and active/active configurations

Re: Panorama and active/active configurations