Do I need an edge router in front of my Palo Alto?

[M.Gannon]

having a general discussion about architecture with a colleague and after thoughts from a wider audience.

By deploying my Palo Alto in an Active/Active pair I can connect my firewalls directly to the ISP/MSP and use BGP to control route traffic.

My colleagues suggestion was it still needs the CE router where you can apply a simple zone based firewall/ACL on the router to limit the scope of traffic hitting our firewall. But I don't see any benefit in this. You can use Active/Active to overcome the limitation of needing FHRP for failover.

I was just wondering on other peoples thoughts.

[Raido_Rattameister]

Depends if ISP advertises full Internet routing table or only default route (and maybe routes originating from their AS).

[OtakarKlier]

Hello,

My thoughts on modern design is you dont. But I'm sure there are special cases where you might.

Regards,