Palo Alto VM seris HA and vSYS

[Zurattos]

Hello,

I have a question regarding Palo Alto VM series HA and vSYS, when I tried to create a new profile with the credit needed for two virtual Palo Alto each one of them installed on a seprate ESXi host , but both ESXi host are in the same location and they have the same network and we need them in HA active/active mode , I choose to add flexible vcpu because we are not sure if we are going to need more sessions means more resources in the future or not , at that moment choosing the number of vSYS was mandotry I added 1 , but to be honest I don't know what is vSYS used for and my question is it going to affect the two virtual Palo Alto behaviour or the HA ??

king regards

[laurence64]

Hi,

Basically vsys or virtual systems provide segmentation of administrative access, management of polices, objects and so on, by default all firewalls have vsys1, although in HA you will need to make sure that both firewalls have multi virtual system capability either enabled or disabled, if you do not intend to use multi-vsys don't enable it and you should see no difference in behavior.

It is worth noting all firewalls have vsys1 by default so the license probably won't cover multi-vsys capability.

[Zurattos]

Hi @laurence64 

Thanks a lot for the answer, in fact we are not using vSYS, and as I mentioned I had to choose 1 , as you told me this is by default , but my question because we won't enable vSYS , is going to affect the traffic or HA ?

[laurence64]

Hi,

No there is no impact to traffic behavior or the way you configure the HA