High Availability across a Fibre connection

[BBHLTD]

We are preparing to configure High Availability in Active Active mode on our PA-2020 firewalls in London.  Our first firewall sits in our main site in central London with our DR site sitting outside central London connected together via a 1Gbp Fibre.

Both sites have a 200Mpb Internet connection so it would be good to make use of both.  What options have we got for making best use of the pipes?

What would the best way to configure H.A be?  We are unable to directly attach the two Firewalls together so would creating a VLAN for HA work?

I have attached a Diagram of our Network that may halp answer any questions,  i'll probably have some more wuestions to ask so will put them on here when I can

Cheers

Joe

[licenselu]

Hello,

I have such configuration for a lot of customers (mainly banks).

We use VLAN to provide L2 connectivity between the sites.

One VLAN for Control plane (2 interfaces for redundancy) and one VLAN for Data plane (also 2 interfaces for redundancy).

If you use Cisco switches, disable IGMP snooping for theses VLANS. This is not required but it's just an advice...

PS : Putting the name of the company inside the doc its' not really a good idea...

Regards,

HA

[mikand]

Another setup is to use both PA boxes as independent setups with no HA in between.

You will lose the session sync but this way the routers before and after PA will take the loadbalance decisions (and along with IP-SLA through the PA boxes the external routers can decide which site to announce to the Internet or whatever you have on the outside and the internal routers could decide which site should be used to reach outside).

In order to have equal setup (like policies etc) on both boxes you can use Panorama.

You can also use PA in VWIRE mode (but then the dmz vlaning will have to be taken care of the internal router on each site).