Firewall - Interface High availablity

Reply
Highlighted
L1 Bithead

Firewall - Interface High availablity

Hi All,

pa-220-ha.png

In my scenario, i have single PA-220 for guest access.  In trusted zone i would like to keep the interface lelvel (active/standby) high availablity.Interface type as L2.  I couldn't do aggregate interface since it's connected to two seperate switches.

 

How we can achieve this.?? 

 

Thanks in Advance..


Accepted Solutions
Highlighted
Cyber Elite


@Raido wrote:

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)


I did this exact setup for a 220 HA pair.  With a 3750 stack.  I actually ended up using port-channels though on the internal and external interfaces.  This got me device redundancy on both the firewall and switch side.

 

But like @Raido mentioned.  an access vlan config to each switch should work just fine.

View solution in original post


All Replies
Highlighted
L7 Applicator

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
Cyber Elite


@Raido wrote:

You could set up Palo interfaces in Layer 2 mode.

But check spanning tree settings so that it would block link between switches that goes through Palo and not between core switches :)


I did this exact setup for a 220 HA pair.  With a 3750 stack.  I actually ended up using port-channels though on the internal and external interfaces.  This got me device redundancy on both the firewall and switch side.

 

But like @Raido mentioned.  an access vlan config to each switch should work just fine.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!