How to set up two HA (active / passive mode) firewalls to be managed by panorama

[HankHsieh]

Hi All,

I already have two firewalls to set HA and use Active / Passive mode.
But when I put both devices into the same Device Groups and Templates and push the configuration file to both devices, the HA settings of the second device will be overwritten by the HA settings of the first device.

I saw this "Migrate a Firewall HA Pair to Panorama Management"

It mentioned that it seems to set variables

Please help me.

Thank you!

[JoergSchuetter]

The setup looks like this:

Besides this, there is only a config for the management interface certificate in the node template.

[vsys_remo]

Hi @JoergSchuetter 

Thanks for sharing. In this case I will give it another try.

The question now is why does paloalto write in the adminguide that IP addresses of HA firewalls can only be configured locally ... @kiwi do you may have the answer?

Edit: @JoergSchuetter what PAN-OS version do you use? When I configure the HA IPs in panorama template stack, they are not applied to the firewall. All the HA config works, but when I check locally on the firewall the IPs aren't from the template...

[JoergSchuetter]

@vsys_remo : We are using this template stack since version 8.0 (works well with 8.1 and 9.0).

One initial step is to clean up the local stored config:

delete rulebase

delete zone trust

delete zone untrust

delete network virtual-wire default-vwire

delete network interface

delete network tunnel

delete network ike

delete network virtual-router default

delete deviceconfig system update-schedule

delete deviceconfig high-availability

delete deviceconfig system timezone

[vsys_remo]

@JoergSchuetter 

Did exactly that (besides the HA config I have nothing locally), but there is no value for HA IP address locally on the firewall ...

[JoergSchuetter]

@vsys_remo 

What do you mean with "no  value for HA IP address locally"?

It will not be listed on the CLI using "show ..."

Does it show up in the GUI of the firewall?