How Many public IP be required to setup full HA Active-Active Mode With two Palo Alto NGFW 3020?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

How Many public IP be required to setup full HA Active-Active Mode With two Palo Alto NGFW 3020?

L1 Bithead

Hello Geeks,

 

I would like to ask for your kind support on my issues of 'How Many WAN IP will be required to setup full HA Active-Active failover mode with two Palo Alto NGFW 3020?' First of all, I would like to appologize you all if my question may make your mind complex. We already bought NGFW 3020 firewalls (Two) to upgrade our organization network design for better visibility and security. During the product shipping waiting time, we are discussing about new network design with vendors. We have total of two internet uplinks from two different ISP and we wanted to make a full HA active-active failover mode with these two firewalls, so they made the draft network design based on our current network design. Unfortunately, as we want to use the internet link directly to firewall WAN ports without any routers or switches in front of firewalls except ISPs' WAN switches, the vendor made full HA active-active failover design with two wan link from each ISP connection to each firewall's WAN Ports for full HA modes with full redundancy. So the total WAN link become 4 links to two firewall by connecting two cables for One ISP to each firewall's WAN 1 port and another two cables for other ISP to each firewall's WAN 2 port respectively! Now the problem is coming as the vendor said we need total of 6 Public IP addresses (Each firewall need 3 Public IP for 2 Internet Uplink from 2 ISP and 1 floating IP address)! For us, we don't clear why we need 3 Public IP for each firewall. Can't we make it only with two Public IP only and others with private IP addresses including for each floating ip address? As pulic ip are very expensive to purchase in our country, we want to use only minimum public IP in our design! Is it possible or we have no way except using all IP as public IP (for total 6 public IP)? Please kindly help me with this issues and greatly appreciate for all of your kind supports! So sorry for my long writting also.

 

1 accepted solution

Accepted Solutions

L6 Presenter

PA cluster works with single IP needed for each interface.

View solution in original post

1 REPLY 1

L6 Presenter

PA cluster works with single IP needed for each interface.

  • 1 accepted solution
  • 3163 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!