How to add firewalls in active/standby mode in panoroma

Reply
Highlighted
L0 Member

How to add firewalls in active/standby mode in panoroma

How do I add firewalls in active and standby mode in panoroma if both active and stanby firewalls have same interface defined 

. In this case ethernet1/21 and ethernet1/22

Highlighted
L7 Applicator

Hi Kirit

 

Are you encountering an issue or error message ?

There should not be an issue with adding both devices to panorama with both having the same interfaces, as this is a requirement for a HA pair

 

reaper - PANgurus.com
Find my book at https://www.amazon.com/dp/1789956374
Highlighted
L0 Member

How does HA work in palo alto? Does it use vrrp? We want to use active/passive config but we want to assign different physical ips to each interface on active and passive firewall?

Highlighted
L7 Applicator

Regardless of the HA mode used (A/A or A/P), each firewall retains it's unique/dedicated out-of-band management IP address.  The differences between the two are more apparent on the firewall/dataplane interfaces:

 

Active/Passive:

 - The Mac/IP Addresses for the dataplane interfaces are owned by the active firewall.  Nothing is present on the passive firewall (except for it's dedicated/oob management port).  In the event of a failover, the Mac/IP addresses float from the previously-active unit to the new active unit.  

 

Active/Active:

 - Is more complicated.  Can be configured where no IP addressing is shared between firewalls, or can be configured with some shared addressing along with some dedicated addressing.  

 

Generally speaking, I would recommend Active/Passive high-availability unless your network design has the possibility of asymmetric routing (ie: packet leaves firewall 1 via ISP1 and returns via ISP2 through firewall2).

 

Do you want each firewall to have a unique IP address just for management purposes, or is it to accomodate the network architecture north/south of the firewalls?

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!