HA Clustering Info

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

HA Clustering Info

L1 Bithead

Hi all,

i have a question for all:


i have two datacenter  in two different city. The datacenters comunication in Layer 2 witn VRRP.

In primary DataCenter (active) i have two FW in Active/Passive (Peer HA), i would configurate a new FW in secondary data center (in passive mode), same model FW, it's possbile? how to configuration this scenario?


Thank you.




Cyber Elite
Cyber Elite


Possible yes since your HA interfaces can be any of the interfaces on the PAN. My biggest question would be why? Have the secondary data center PAN standalone and active. You can control routing via OSPF and route metrics.


Just my thoughts, I'm sure you have specific requirements.



L1 Bithead

the datacenter passive, it's work only for disaster recovery. 

Cyber Elite
Cyber Elite


I've done similar configs, and my DR data center was active. just disable the inbound NAT's. However you should be able to set it up the way you described.

Just a thought.

OK so every FW in the cluster in Active/Passive I have to configure HA1, HA1-Backup, HA2, HA2-Backup and H4, HA4-Backup and all interconnected? Are there any guides?

Cyber Elite
Cyber Elite


Hopefully the answer lies in the following:





Hi @VFaticati ,

Can you clarify if I get your question correctly - you want all three firewalls to be in HA cluster and share session information?

If I understand that correctly, it is possible, this feature was introduced in version 10.0, so you need to use 10.1 and above (10.0 is no longer supported).


The following gives overview of the feature - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-clustering-overview   As you can see from the link only some devices are supporting such setup, so you may check that as well.

There is also the steps how to configure "HA clustering" - https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/configure-ha-clustering

Hi @aleksandar.astardzhiev ,


For the case you mentioned, is it require a load balancer for session distribution? for my case all of the gateway are required to terminate on PA firewall, and same as @VFaticati , one DC with A/P HA, and the other one is standalone.



  • 7 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!