Data center providing dual ports already in VRRP - my topology?

[MarkGorman]

I will have a single PA device in the cabinet, so no HA on my end. I understand the risks and this is not part of the question.

Datacenter/Colocation is providing me dual ports into the cabinet and they are handling VRRP through their IP blend. They will provide me a /29 with the first 3 IP's being the VIP, R1 and R2 addresses.

I am being told that I need to plug each port handed to me by the data center into two different l2 switches and then plug those into my L3 device (The firewall).

My question is.. If they are handling the VRRP on their end, do I really need to add two switches (introducing two more points of failure) when the switches would solely be used as a middle man between the data center and the firewall? I had originally thought that I could plug them directly into two sfp+ ports on the firewall and mark those ports as layer2. I would then have port 3 go to my internal LAN switch. Then, I could add a virtual router entry to round robin my traffic from port3 to port 1 and 2 with the added bonus of not losing internet if one fiber lead goes out.

I am not experienced in VRRP, and everything I am finding is talking about me setting up the VRRP on the Palo, which is not the case in my use case as it is handled at the data center's end. 

[TomYoung · Accepted solution]

Hi @MarkGorman ,

You are correct.  You do not need 2 switches.

You would configure your 2 interfaces on the NGFW as L2 ports in a L2 zone in a single VLAN.  You would then configure a L3 zone and L3 VLAN interface tied to the same VLAN.  When the NGFW ARPs for the MAC address of the VIP, only one of their routers will respond.  The MAC address will be learned on the correct interface, and the NGFW will forward traffic to it.

You do not need to configured a 2nd virtual router.

Thanks,

Tom

[MarkGorman]

Thanks for the reply @TomYoung . That makes sense.

So, that now brings me to GP and IPSec. Would I, in the IKE gateway config and GP Portal config, just assign the interface in the dropdown to the vlan created for the L2 as described in your reply instead of what I'm used to (ie ethernet1/1)?

[TomYoung]

Hi @MarkGorman ,

You would assign the L3 VLAN interface.  It will be configured with your IP address.

Thanks,

Tom