Active/Passive HA L3 only using Bowtie connectivity between PA3410 and Cisco ISR4431

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Active/Passive HA L3 only using Bowtie connectivity between PA3410 and Cisco ISR4431

L1 Bithead

I have a request from my customer to implement the following HA setup where the PA 3410s are Active Passive to their partner that has 2 MPLS connections from different telcos where one side is generally the active side we'll call it Sprint and the failover side is Ma Bell. There is an image of diagram floating out there that shows bowtie looking connectivity. Photo attached. Looking at Palo Alto's KB I can't find anything like this. The image is out there on reddit at this link - - and I get the consensus from this that it may be possible but no real supporting documentation one way or another. Is this doable? Where would I find an example in Palo's KB articles because I've searched based on this term - 'PA firewall active/passive failover using bowtie lan architecture' a well as ' PA firewall high availability active/passive to separate MPLS L3 connections back to back with routers'. Maybe my search string is too broad. I don't know. Anyone out here ever done this. I don't get the vibe this is doable.




Cyber Elite
Cyber Elite

this is perfectly doable, your approach will depend on a few things


from connectivity perspective, do both links in the bowtie need to use the same subnet, or are they different links?

in case each router has a different subnet, simply configure your interfaces with the appropriate IP/subnet and pick one of the following:


  • you can set up simple static routing (with path monitor) and leverage metric to choose your path
  • you can set up ospf (or BGP?) to prefer one uplink over another
  • you can use policy based forwarding (PBF) to send certain (or all) sessions via one link, and the rest via the other
    • enable symmetric return to 'fix' asymmetry in case both links do send packets
    • set monitoring for automatic failover to the secondary link
  • enable ECMP (equal cost multi path) to use both links simultaneously (enable symmetric return to maintain symmetry) and you can assign a higher/lower cost to each link so one is preferred over the other or simply load share


if both interfaces need to be in the same subnet, it gets a  little more difficult:

  • you can set both interfaces to layer2 mode and create a layer3 vlan interface, so the same ip.subnet lives on 2 interfaces
  • you can create an aggregate interface and connect each interface to a different router. on each router you would also set up LAG and connect both palo's



hope this helps

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization



Thanks for the insight. I'm going to review what you recommended and look into the points relating to your recommendations. I'll respond more later here after I bounce it around to the router guys on my team because I will be relying on their input as well. Thank you again for your response.


The current set up is Cisco ISR (Partner) to ASA (my customer). ASAs are an active/standby config.Currently we have a /29 for the Sprint and the AT&T side. We are moving from the ASAs to PA 3410s.
The partner router is and the ASA is (with a standby IP of on the Sprint circuit).

The AT&T circuit side is on the partner router and on the ASA with a standby of for the standby IP.

Current partner network is & and both partner networks are reachable through either circuit depending on the active data center on the partner side. Sprint circuit is preferred. Partner has their ISR routers in my customer's data center going back to their data centers via MPLS. We static route both of the partner networks as follows: & via metric of 1 to Sprint path. & via metric of 5 to AT&T path.

I want to use a dynamic routing protocol preferably BGP to cover routing in the new setup. The firewalls being in active/standby Firewall 1 being the nominal active would share the IP of with the standby firewall if it fails over for instance. I have attached my draft diagram if you want to review it. This is very rough and if we run BGP we would have to filter on the Palo Altos to keep any potential overlap out of the system.

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!