Firewall - Interface High availablity

[gpsriram]

Hi All,

In my scenario, i have single PA-220 for guest access.  In trusted zone i would like to keep the interface lelvel (active/standby) high availablity.Interface type as L2.  I couldn't do aggregate interface since it's connected to two seperate switches.

How we can achieve this.?? 

Thanks in Advance..

[Brandon_Wertz · Accepted solution]

---

@Raido wrote:

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)

---

I did this exact setup for a 220 HA pair.  With a 3750 stack.  I actually ended up using port-channels though on the internal and external interfaces.  This got me device redundancy on both the firewall and switch side.

But like @Raido mentioned.  an access vlan config to each switch should work just fine.

[Raido]

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)

[Brandon_Wertz · Accepted solution]

---

@Raido wrote:

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)

---

I did this exact setup for a 220 HA pair.  With a 3750 stack.  I actually ended up using port-channels though on the internal and external interfaces.  This got me device redundancy on both the firewall and switch side.

But like @Raido mentioned.  an access vlan config to each switch should work just fine.