topic Re: High Availability for Firewalls in diferent locations over Layer 3 network in General Topics

High Availability for Firewalls in diferent locations over Layer 3 network

samuel.lora3 — Wed, 18 Aug 2021 17:47:20 GMT

Is it possible to configure high availability between Palo Alto VM series Firewalls that are located in different buildings over a network to connect both firewalls?

I have two VM-300 Firewalls that are Active/Pasive with Global Protect in the same physical Server, which will result in a single point of failure. Recently there was an electrical issue and the server went down. Since both firewalls are in the same server, the remote users were not able to connect to company network.

Is there a way I can configure HA between one of those Firewalls and a new one that would be located in another building, separated by layer 3 network, so that in case something happen with one building, the Firewall in the other building would take the traffic? I know there have to be routing protocol in between which is fine but I am concern if the High Availability can be configured for two separate firewalls.

Re: High Availability for Firewalls in diferent locations over Layer 3 network

BPry — Wed, 18 Aug 2021 20:46:12 GMT

@samuel.lora3,

That'll work fine, the only think thing that you'll really have to be mindful of is possible adjustments required for HA timers depending on the quality of that connection.

https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/about-the-vm-series-firewall/vm-series-in-high-availability.html

Re: High Availability for Firewalls in diferent locations over Layer 3 network

samuel.lora3 — Thu, 19 Aug 2021 02:33:23 GMT

@BPry

Thanks for the reply and the link. I am reading through this topic. I would simulate it first to know how feasible will be for my network topology.

Re: High Availability for Firewalls in diferent locations over Layer 3 network

TomYoung — Fri, 20 Aug 2021 03:35:24 GMT

Yes, it has been done many times as long as the latency is fine. PANW unofficially recommends 20ms or better between firewalls. Customers have reported it works fine with 80-120ms. Check out this video starting at 1 hour 15 minutes. Bandwidth should also be considered. https://www.youtube.com/watch?v=4hFQypgOAGk&t=4665s

Re: High Availability for Firewalls in diferent locations over Layer 3 network

OtakarKlier — Fri, 20 Aug 2021 18:07:43 GMT

Hello,

Also please consider everything in the HA path, i.e. switches, routers other devices, etc. Make sure they all have battery backup and/or alternative power sources.

Regards,