Dual ISP Branch Office with PA HA (2 PA with HA Configured

[Doug_Hogue]

I see examples of using 2 ISPs with one PA. I also see that senario with Global Connect, Lad Balancing and IPSec Tunnels. However, I do not see where it states these types of senario's can be used in a PA-200 HA senario. Can anyone shead some light on using Dual ISP's with HA Palo Alto Firewalls.  I know the fail-over is different on the PA-200, for example no session sync. Thanks in Advance.  

[rmonvon]

Hi...Yes, you can use those methods with 2 PAs in HA.  You just need to make sure the 2 PAs are connected to both ISPs using the same Ethernet ports so that when a failover occurs, the active PA can reach the 2 ISPs.  

[tsrivastav · Accepted solution]

If you are concerned about the Fail over part its a kind of stateless failover.

Means in case if one PA 200 went down there may be 4 to 6 pings packet drops but all the functionality will remain the same.

PA 200 HA--->>>  we call it as HA lite means there will not be immediate faiover and may take some time to establish the sessionsas i mentioned above.

In case of 3K,5K series  fail over you may see only 1 ping packet drop during a failover in the network

But Again there  wiil be no change in kind of  configurations and will reamin same  similar to the other boxes.

Hope that answers your question

Tarang

[pulukas]

The other thing to be aware of with inbound services failover like Global connect is how your inbound prefix routing failover will occur when you lose an upstream ISP.  Depending on how the route advertisements are working this can take some time for your upstream to remove that path and all your existing sessions to find the new inbound path on the second ISP.  Especially if this is an active/passive failover.

Naturally, if you do not have the Glbobal protect prefix available to advertise in both ISP then it cannot failover at all and new connections must be made using the second ISP address space.