HA4 Clustering to present a single NAT IP across two Data Centres

[Rich.H]

Can anyone who is using the HA4 cluster in production, to present the same external NAT IP across 2 data centers give any advice on how they are doing the routing.  I saw in the docs that some of the security functions don't work if the traffic is asymmetric.  Obviously the easy answer is to push all the traffic to one DC.  Is that how people do it, or is there a way to load balance across them?

I am keen to hear about peoples experience with the feature and if they have had any issues with it.  Currently I have two separate IP ranges for the two DC's and flip flop between them, but that is a pain.

[LAYER_8]

It's important to note that HA Clustering is not the same thing as Active/Active HA. You are correct in that there is no L7 inspection support for asymmetrical traffic.

My customers using this feature are from a failover / disaster recovery scenario, so not load balancing traffic across two datacenters. 

If you are trying to utilize it for horizontal scaling to get the above scenario working we would recommend a load balancer sandwich, which is another way of saying NAT'ing the DCs to be the same public IP and load balancing with HA Clustering is not a supported use case at this time, but with additional devices you could achieve the functionality. 

[Rich.H]

Failover/DR is my primary driver for this feature.  I want the same IP to be used at both of the DCs so that it doesn't affect the IP address that our partners have white listed.  What I am unsure of is if the address is pinned to one site or floating, how do we make the inside and outside routing line up so things are symetric

[LAYER_8]

You use a load balancer sandwich where the northern/outside LB is floating the IP between the DC connections to the NGFWs. LBs behind the NGFWs to keep flow symmetric (or rerouting when the wire fails). 

That is, you need the DC LBs to be connected to the opposing NGFWs as well as their local, and both DC NGFWs to the northern LB.