2X of PA820 Active/ Passive Design question

[craigpaolozzi]

Hi All

After some advice, planning to have 2 X PA820 pairs of Active/ Passives, Inner and outer firewalls protecting some internal networks.

See the diagram, Does the HA2 link pass data plane traffic at all?  Or can it?

There could be a scenario that one set of FW's can failover and the primary unit of one trying to speak to the standby unit of the other.  

Or is the only solution to put a switch in between the green cables FW Connect to stop this issue?

Thanks All

[craigpaolozzi]

Yeah, thanks for clarifying.

I propose to use a switch to connect the fw interconnects together.

[jeremy.larsen]

If this were me (and it's not),  I would STRONGLY suggest that your customer reconsider this design proposal.  This looks like it could turn into a real nightmare to manage with a ton of traffic being unnecessarily processed twice by the same firewall engine.  The only scenario I would even consider this in, is one where each pair is managed by a different team without overlap.  Even this, would have to be a forced security requirement on me.  My two cents. Good luck to you.

PS - Even better, I would talk to Palo about trading in those 4 firewalls for 2x of a more powerful model.

[craigpaolozzi]

I may see if thats possible...but I doubt it.

very little traffic traverses the firewalls pairs.....syslog, snmp, icmp thats it basically.

[craigpaolozzi]

Another quick question sorry...

In PA Active/ Passive - they share the same interface IP's (except the management ports)

In a Cisco ASA world, if I wanted to logon to the Passive member, I could do by using the Standby address of the firewall.  But in Palo Alto world that's not possible as interfaces don't have standby address.

I'm assuming the only way I can achieve the above is by using the management ports on each of the firewalls, then I can logon to the Passive node via the management IP.  

We are going to be using Panorama too

[jeremy.larsen]

I've run into this a lot.  The first thing I tell people recovering from ASA... is take everything you know about firewalls and perform a memory dump.  ASA is a slowly dying dinosaur that has somehow survived on the Cisco name alone.  PAN operates completely different and the sooner you accept this, the sooner you will be happy, successful and never look back.  Management ports on the PAN run on the Control Plane and can be thought of as running on an independent OS with it's own routing table, ACL, etc.  If you have any familiarity with Juniper, it's almost the same.  To answer your question, Passive Nodes are available using the Management port completely independent of the Active Firewall. If you plan on using Panorama, don't set up your firewalls and then port to Panorama later.  You will regret it.  Step one of my Panorama deployments is to completely wipe the config on the Firewalls.  All configs/settings/updates/etc are then wholly managed and pushed from Panorama.  It is a top tier product and makes life full of awesome.  It really sounds to me like you guys need some PAN training.  I can't recommend this enough and you should talk to your PAN Rep ASAP.