2X of PA820 Active/ Passive Design question

[craigpaolozzi]

Hi All

After some advice, planning to have 2 X PA820 pairs of Active/ Passives, Inner and outer firewalls protecting some internal networks.

See the diagram, Does the HA2 link pass data plane traffic at all?  Or can it?

There could be a scenario that one set of FW's can failover and the primary unit of one trying to speak to the standby unit of the other.  

Or is the only solution to put a switch in between the green cables FW Connect to stop this issue?

Thanks All

[craigpaolozzi]

Thanks for that, so I  will use the Management ports.

Yep we are waiting for training costs, 

I would manage both pairs via the management address from Panorama?

[jeremy.larsen]

Yes.  It is possible to change this behavior, but you would be locking yourself out of the passive node.  Stick with the management interfaces and you'll be fine.

[craigpaolozzi]

Great, thanks for the advice BTW,

I should be able to keep the interface on the Palo Alo set as Layer 3 shouldnt i?   Or will I have to change to a L2 interface ? I need to be able to have a IP address on the interface for the static routing.

L2 VLAN, vlan id 555 for example, and all 4 ports will sit in that VLAN.

[jeremy.larsen]

I highly recommend using Layer 3 sub-interfaces instead of vlan interfaces unless you've got some strange Layer 2 requirements.

[craigpaolozzi]

Cool will setup L3 sub interfaces, and tag the vlan to the correct access vlan defined on the switch 

[jeremy.larsen]

[craigpaolozzi]

or i could fully mesh alll 4 Palos and have two sets of static routes.....but you suggest going via the switch?