We are excited to announce the availability of DPDK support for the VM-Series when using Active-Passive HA on AWS. With this support, you can now protect your traffic with improved throughput performance interfaces, while also experiencing a much faster failover experience.
VM-Series in AWS
In AWS, customers leverage the VM-Series as an ingress security gateway for traditional IaaS and Kubernetes workloads. In addition to the native security functionality offered by AWS, the VM-Series augments native cloud security by delivering first-class application visibility, control, and threat prevention. VM-Series HA support for DPDK further strengthens our capabilities in AWS by providing traditional HA functionality without a tradeoff in performance.
Understanding the VM-Series HA Improvements in AWS
IP address swap during failover
VM-Series Plugin for AWS
The VM-Series plugin provides High Availability support in AWS. When the active VM-Series fails, The failover mechanism moves all the secondary IPs of the data interfaces to the corresponding interfaces of the passive VM-Series. The failover mechanism updates the route rules on your VPC route tables with the passive VM-Series Elastic Network Interface(ENI) as the next hop.
The failover mechanism is a significant change compared to the previous iteration that hot-swaps the Elastic Network Interface(ENI) during failover. Because DPDK doesn't support Hot-Swap interfaces in AWS, this method not only improves performance, but it enhances failover speed as well.
The minimum PAN-OS software version is 9.1.x
The minimum VM-Series plugin for AWS version is 1.0.12
You can not deploy the VM-Series in different zones
Generally available at the end of August
Be sure to change your Plugin HA mode to secondary-IP by running the following command >request plugins vm_series aws ha failover-mode secondary-ip
We encourage you to learn more about this enhancement by watching the demo video.