panorama and clustered PA's

[Alex_Samad]

Hi

So if your managing a clustered set of PA's with panorama.

Do you have "synchronise config set" or unset and let panorama write configs to both ?

Is there any thing wrong with having it set and having both units managed by panorama ?

[reaper · Accepted solution]

hi @Alex_Samad

during HA config sync only the device local config is synced over to the peer, panorama config is not synchronized and needs to be pushed to both firewalls from panorama.

it's perfectly fine th sync config between HA peers and also have paorama pushed config

here's a list of all the things that are NOT synchronized :Reference: HA Synchronization

[Alex_Samad]

Hi

Yes I understand I have to push. 

But I have both pas attached to panorama - as pa1 pa2. and they sync to each other.

so when I do a push from panorama is pushes the same (the shared bits ) to pa1 and pa2 and then pa1 pushes to pa2 and pa2 pushes to pa1.

Seems like if I am using panorama I shouldn't need to sync configs ...

But I loose out if I make a change locally on pa1 as it will not sync over to pa2 .. 

[reaper · Accepted solution]

Hi @Alex_Samad

panorama config is not synced so if you push panorama config to PA1 only, it will not be synced to PA2

on the device, local and panorama config are distinctly separate from eachother and only the local config (local policy, local objects, ... ) will be synched