How can use loopback for virtual Ip

[Pattarachai]

Hi expert ,

I would like to know about that if that possible or not about use loopback interface on palo alto such  as Virtual IP same like VRRP in a scenario don't to downtime  use VIP 

Thank you  

[reaper]

Yes, you can use virtual interfaces so an IP is always available independent of an interface's status.

We do not support VRRP, however, in case you also wanted that functionality

[aleksandar.astardzhiev]

Hi @Pattarachai,

Can you explain a bit more your setup or what you want to achive?

Like any other vendor Palo Alto support

- active-standby cluster - where you deploy to FWs in HA cluster. Both firewalls share same IP address and in case of failuer on the primary member traffic is handovered to secondary member. Since both member are using same IP address for the rest of the network nothing has changed

- active-active cluster - wher both FWs in the cluster are active and used different IP address. BUT you can configure VIP (floating IP) which can be used by the neighbour devices to forward traffic to only one of the member. In case of failuer the secondary member took over the VIP addresses

- If you want to run VRRP between the FW and a router, so in case of failuer in the firewall the traffic to be send the router, so you will loose security, but will maintain connectivity - Unfortunately that is not possible. Palo Alto doesn't support any First Hop Reduncency protocols (VRRP, HRSP etc)