How to set up two HA (active / passive mode) firewalls to be managed by panorama

[HankHsieh]

Hi All,

I already have two firewalls to set HA and use Active / Passive mode.
But when I put both devices into the same Device Groups and Templates and push the configuration file to both devices, the HA settings of the second device will be overwritten by the HA settings of the first device.

I saw this "Migrate a Firewall HA Pair to Panorama Management"

It mentioned that it seems to set variables

Please help me.

Thank you!

[vsys_remo]

Hi @HankHsieh 

I would configure the HA config locally on the devices and not in the template on panorama. This way you will have a lot less troubles. Some of the HA config you can configure in panorama with different device specific templates so that both devices have different configurations, but at least the HA IP addresses you must configure locally on the device (https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-templates-and-...) so I recommend to simply configure HA completely local.

[JoergSchuetter]

Hello

We are creating template stacks, one dedicated stack per node

1) node specific template

2) system specific template

3) general template

In the node specific themplate the HA settings are set. Everything else is configured in the system specific template. This ensures that no config (except mgn interface related one) needs to be done on the firewall nodes, everything is managed by panorama.

[vsys_remo]

@JoergSchuetter  how did you manage to configure the HA IP adresses in a template on panorama? I would also prefer to use the template for everything but because of the HA IP addresses there was such a mess that I simply changed to configure everything HA related locally.

[HankHsieh]

After I managed the device from panorama,

I used the same template and device group for both HA devices, and set all HA configs of this template to variables, and manually set the HA settings locally on the passive device, which works normally!