PA-850 High Availability Cabling

[GajananDixit]

Can we separate the PA-850 two of HA boxes using Fiber to Copper Media Convertor in case I want to keep both boxes in different buildings to achieve HA  ( our boxes are in Active-Passive mode ) ? 

Current configuration of HA is on Copper Ports.

[TomYoung]

Hi @GajananDixit ,

Yes, it can be done.  Check out this discussion -> https://live.paloaltonetworks.com/t5/general-topics/high-availability-for-firewalls-in-diferent-loca....

You can use IP addresses for your HA2 links so they can route across your network.  In that scenario, PANW recommends encrypting the traffic.

Thanks,

Tom

[BPry]

@GajananDixit,

If you're going to use a media converter the only thing I would really caution is using cheap devices for these links. I'd recommend spending the money for a managed unit so that you can monitor for faults outside of the interface just failing.