How to use Seprate IPs on WAN interface of 2 Paloalto Firewall.

[aamirns]

Im new in PaloAlto and configuring HA Active/Passive Mode with seprate IPs on WAN Interface in both Firewall, every thing is working fine but when Active Firewall 1 Syncronized with Firewall 2 its change the Firewall 2 WAN IP with Firewall 1 WAN IPs in that case my all routing to oustside is Block in Firewall 2 because it has different route outside than Firewall 1.

Any one kinldy can guide me how i can design PaloAlto firewall WAN interfaces using Active/Passive Mode in case of Single ISP for both firewall or Dual ISP for better redundancy.

[rmfalconer]

Why do A/P HA devices need different routes?

[aamirns]

If we have two internet connection from same ISP or from Different ISP. for redundancy.

[rmfalconer]

You need the redundant circuit connected to both PAs, just like the primary.  Interface configuration and routes sync between active and passive nodes. Link - What doesn't sync between active/passive 

Then you'll need to choose how to utilize both circuits during normal operation and during failover.

[aamirns]

If you can see my visio i have only 2 internet connection one for each firewall either from Same ISP or Dual ISP.  every thing is working fine so far with Left side Firewall is in Active mode, but in case of failover when right side Firewall will become Acitve i want my traffic should go through its WAN IP. Problem is this HA syncrozised changed the WAN IP to same for both firewall. how i can overcome this situation WAN IP should be identical for both firewalls not same

[OtakarKlier · Accepted solution]

Hello,

in Active/Passive mode, the WAN IP's will be the same on the active firewall. Lets say Active firewall has IP 1.1.1.1, if there is a failover event the passive(no active) firewall will have its WAN IP of 1.1.1.1. There are only a few things that do not sync in HA, they are all on the Device tab. 

Here are some links for reference:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIbCAK

Regards,

[LuisSantoTomas]

Is not possible to use any switches? In this way, you can connect the ISP to both FW (on the same port) without any problem. If you want to use another ISP for redundancy, use another port for both fw too.

[OtakarKlier]

Hello,

You sure can, just need to make sure that the configuration and routing is correct. However with regards to HA, in active/passive mode, only 1 firewall is Active so the other one has its ports shut down.

Regards,

[CosminM]

Hello,

If you configure your ISP connections on separate firewall ports you should achieve what you want.

For example:

ISP1 configured on Ethernet1/7 and ISP2 configured on Ethernet1/8.

On the active firewall connect only ISP1 on Ethernet1/7 and on passive firewall connect only ISP2 on Ethernet1/8.

On both firewall you will have 2 default routes pointing to every ISP next hop and the active firewall will chose one of them based on connectivity status.

Also, you need to take care of some source NAT, if it's the case.

Basically, you will make the configuration like both ISP are connected to the same firewall. on different interfaces.

What will be different, and you will configure on each firewall are automatic failover conditions.