PAN firewall HA and addition of same to Panorama

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

PAN firewall HA and addition of same to Panorama

L3 Networker

We are having an existing panorama in our network via which multiple production firewalls are managed  and in one of the location we are planning to implement two new firewall in HA ( active -passive) set-up.

question is : Do we need to add the firewall first and later need to configure HA or  add the devices in HA first later we need to add them to Panorama. What would be the best practice.

 

2 accepted solutions

Accepted Solutions

Cyber Elite
Cyber Elite

Thank you for reply @Sujanya

 

yes, if you are planning to manage HA locally in the Firewalls, I would suggest to remove it from Template, however even if you do not remove it, by default the local configuration will take a precedence.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

L3 Networker

Hi Pavel,

 

Thanks for clarifying the details. It is helpfull.

View solution in original post

6 REPLIES 6

Cyber Elite
Cyber Elite

Hello @Sujanya

 

I can only speak for my own experience. Although, it is possible to completely manage a Firewall HA pair from Panorama including HA config in a single template stack by leveraging variables:

https://knowledgebase.paloaltonetworks.com/kcsArticleDetail?id=kA10g000000PNG0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POI2CAO

 

I personally found it easier and less error prone to setup a basic config like management interface and built HA first, then add the Firewall pair to Panorama and push the rest of the configuration. I have not found any document/design guide that would state would the best practice would be in this scenario, however since HA setting is mostly one time setup that we do not modify frequently, I decided to keep HA as an exception and manage it locally on Firewall instead of pushing it by Panorama. As of now we have 150+ Firewalls and I have not felt that this strategy needs to change.

If you add a Firewall pair to Panorama and later decide to let Panorama to manager HA, then you can always push HA configuration from Panorama Template and override it locally without using Force Template Values.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L3 Networker

Hi Pavel,

 

Thanks for the wonderful suggestion. To configure HA and to migrate the same over Panorama, I have got this KEDB document. Where Step 5 is to import the configuration to the firewall. In our case the only configuration which is available in firewall is mgmt IP and HA configuration.

So the question here is do we need to skip step 5.

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall...

Cyber Elite
Cyber Elite

Thank you for reply @Sujanya

 

the link you shared is for a scenario when you already have an existing Firewall with a full configuration and you want to import Firewall configuration into Device Group/Template Stack and then push it back to Firewall from Panorama.

 

Since your Firewall has blank configuration, there is no pre-existing configuration to be imported into Panorama. You can instead refer to this link to add the Firewall to Panorama: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-m.... Before you add the Firewall to Panorama, you can create desired configuration in Device Group and Template/Template Stack and add those during initial Firewall onboarding or you can add those later under: Panorama > Device Groups / Templates.

 

Kind Regards

Pavel 

Help the community: Like helpful comments and mark solutions.

Hi Pavel,

 

Thanks for the steps. Having one last confusion , before pushing the configurations to newly added firewall , do we need to remove the HA configuration which is associated with the template of new firewalls.

Cyber Elite
Cyber Elite

Thank you for reply @Sujanya

 

yes, if you are planning to manage HA locally in the Firewalls, I would suggest to remove it from Template, however even if you do not remove it, by default the local configuration will take a precedence.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

L3 Networker

Hi Pavel,

 

Thanks for clarifying the details. It is helpfull.

  • 2 accepted solutions
  • 1980 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!