2X of PA820 Active/ Passive Design question

Showing results for 
Search instead for 
Did you mean: 

2X of PA820 Active/ Passive Design question

L2 Linker

Hi All


After some advice, planning to have 2 X PA820 pairs of Active/ Passives, Inner and outer firewalls protecting some internal networks.


See the diagram, Does the HA2 link pass data plane traffic at all?  Or can it?


There could be a scenario that one set of FW's can failover and the primary unit of one trying to speak to the standby unit of the other.  

Or is the only solution to put a switch in between the green cables FW Connect to stop this issue?





Thanks All



L4 Transporter

1. Just curious why you are using the old school Firewall sandwich design?

2. HA2 passes sync traffic for the HA Pair.

3. Why would you put a switch between the two?  Wouldn't you want a router?  Otherwise everything in the middle of the sandwich would need multiple gateways/routes (Yuck, I've seen this).

4. Am I assuming too much based on your limited information?

Cyber Elite
Cyber Elite


Everything @jeremy.larsen mentioned is correct. If you have the interfaces for it and you don't want to utilize a switch/router between the networks, you would need to cable up both units to both units. So both sets of firewalls need a route to both firewalls. Every "Inner" firewall will need a link to both of your "outer" firewalls. That way if you have a failover you actually have a route for it to get there.

A lot of times people will put something like a switch or router between the two just to save on interfaces, especially on the smaller units like the 820 where interface count is minimal. 


Also I'm really going to echo what @jeremy.larsen already brought up, but is something I would really be asking if someone came to me with this design, why are you still using this model? Do you actually need an "Inner" and "Outer" firewall or could you condense these into a larger HA pair.

Thanks for the replies


Ideally yes I would of used a single ha pair of 820s instead of a back to back pair.  But our customer has already purchased them and have asked us to design them basically 😞


So the plan was to use a /30 between both Firewalls, since the Palo altos share the same IP address on the interfaces when in active passive mode.


The idea of putting a switch in the middle would be so the firewalls don't send packets to the passive Firewall as it will drop traffic.


So I would take both FW interconnect ports from both pairs (4 ports in total) and patch them into a new L2 vlan, then when the Firewalls arps for the address that's in the routing table it will respond with the correct active address instead of the possibly one of the active nodes paseses traffic to a passive node and will be dropped.  


Does that make sense?



I'm just trying to help here.  That doesn't make any sense at all unless you were running these Active/Active.  But then that's another discussion.  Traffic will never go to the passive firewall (it's passive after all) and the VIPs will all be on the Active firewall (ARP baby).  I guess I don't really see what you are trying to accomplish here.  A /30 between them doesn't give you any address space in the DMZ/Middle of the Sandwich if you are going "Old School" like this.  Perhaps we are missing some piece of the design here?



Heres a better diagram of the full solution......so this is for an OT environment so sensitive networks.

So there are networks behind the Inner Palo Alto pair.....they will be accessed by the Cisco LAN behind the Outer Pair of Palo Altos



Heres another of the situation I want to aviod;


if the active FW in the bottom pair wants to send traffic north, it will send via the passive not - which will fail

And if HA2 doesnt send the traffic to the active pair....then still the traffic is dropped



if the active FW in the bottom pair wants to send traffic north, it will send via the passive not - which will fail

And if HA2 doesnt send the traffic to the active pair....then still the traffic is dropped

Why  do you thing this will ever be sent via the passive node? The passive node does not accept or forward any traffic, nothing is "alive" so to speak outside of your management interface. It has absolutely no way to send/receive traffic. 


Because the active node in the latest diagram I sent only has a link to the passive node, if that was in active mode it would be fine and would pass traffic.


That would be a design flaw then. As I stated previously if you aren't going to use some sort of switch/router in the middle and directly connect these two clusters you would need to have each individual node to have it's own link to both the opposite firewalls. If that isn't done you don't have a route to the active unit and this breaks your entire design.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!