High Availability for Firewalls in diferent locations over Layer 3 network

[samuel.lora3]

Is it possible to configure high availability between Palo Alto VM series Firewalls that are located in different buildings over a network to connect both firewalls?

I have two VM-300 Firewalls that are Active/Pasive with Global Protect in the same physical Server, which will result in a single point of failure. Recently there was an electrical issue and the server went down. Since both firewalls are in the same server, the remote users were not able to connect to company network.

Is there a way I can configure HA between one of those Firewalls and a new one that would be located in another building, separated by layer 3 network, so that in case something happen with one building, the Firewall in the other building would take the traffic? I know there have to be routing protocol in between which is fine but I am concern if the High Availability can be configured for two separate firewalls.

[BPry]

@samuel.lora3,

That'll work fine, the only think thing that you'll really have to be mindful of is possible adjustments required for HA timers depending on the quality of that connection. 

https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/about-the-vm-series-firewall/v...

[samuel.lora3]

@BPry 

Thanks for the reply and the link. I am reading through this topic. I would simulate it first to know how feasible will be for my network topology.

[TomYoung · Accepted solution]

Yes, it has been done many times as long as the latency is fine.  PANW unofficially recommends 20ms or better between firewalls.  Customers have reported it works fine with 80-120ms.  Check out this video starting at 1 hour 15 minutes.  Bandwidth should also be considered.  https://www.youtube.com/watch?v=4hFQypgOAGk&t=4665s

[OtakarKlier]

Hello,

Also please consider everything in the HA path, i.e. switches, routers other devices, etc. Make sure they all have battery backup and/or alternative power sources.

Regards,