PAN firewall HA and addition of same to Panorama

[Sujanya]

We are having an existing panorama in our network via which multiple production firewalls are managed  and in one of the location we are planning to implement two new firewall in HA ( active -passive) set-up.

question is : Do we need to add the firewall first and later need to configure HA or  add the devices in HA first later we need to add them to Panorama. What would be the best practice.

[PavelK]

Hello @Sujanya

I can only speak for my own experience. Although, it is possible to completely manage a Firewall HA pair from Panorama including HA config in a single template stack by leveraging variables:

https://knowledgebase.paloaltonetworks.com/kcsArticleDetail?id=kA10g000000PNG0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POI2CAO

I personally found it easier and less error prone to setup a basic config like management interface and built HA first, then add the Firewall pair to Panorama and push the rest of the configuration. I have not found any document/design guide that would state would the best practice would be in this scenario, however since HA setting is mostly one time setup that we do not modify frequently, I decided to keep HA as an exception and manage it locally on Firewall instead of pushing it by Panorama. As of now we have 150+ Firewalls and I have not felt that this strategy needs to change.

If you add a Firewall pair to Panorama and later decide to let Panorama to manager HA, then you can always push HA configuration from Panorama Template and override it locally without using Force Template Values.

Kind Regards

Pavel

[Sujanya]

Hi Pavel,

Thanks for the wonderful suggestion. To configure HA and to migrate the same over Panorama, I have got this KEDB document. Where Step 5 is to import the configuration to the firewall. In our case the only configuration which is available in firewall is mgmt IP and HA configuration.

So the question here is do we need to skip step 5.

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall...

[PavelK]

Thank you for reply @Sujanya

the link you shared is for a scenario when you already have an existing Firewall with a full configuration and you want to import Firewall configuration into Device Group/Template Stack and then push it back to Firewall from Panorama.

Since your Firewall has blank configuration, there is no pre-existing configuration to be imported into Panorama. You can instead refer to this link to add the Firewall to Panorama: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-m.... Before you add the Firewall to Panorama, you can create desired configuration in Device Group and Template/Template Stack and add those during initial Firewall onboarding or you can add those later under: Panorama > Device Groups / Templates.

Kind Regards

Pavel 

[Sujanya]

Hi Pavel,

Thanks for the steps. Having one last confusion , before pushing the configurations to newly added firewall , do we need to remove the HA configuration which is associated with the template of new firewalls.

[PavelK · Accepted solution]

Thank you for reply @Sujanya

yes, if you are planning to manage HA locally in the Firewalls, I would suggest to remove it from Template, however even if you do not remove it, by default the local configuration will take a precedence.

Kind Regards

Pavel

[Sujanya · Accepted solution]

Hi Pavel,

Thanks for clarifying the details. It is helpfull.