Setting up portchannel from router to a pair of PA

[tinhnho]

Hi Guys,

I have a pair of PA5220s and a Cisco router ASR1001. I want to set up a port channel on the router and then spread the interfaces between 2 PAs. Each interface on the PA is set for virtual wire. I have done port channels between Cisco routers and Nexus switches (vPC) many times, but I am not sure if the PA firewalls support this setup. If the PA supports this method, what do I need to set up on the PAs before plugging the interfaces of the Cisco router?

Please see my diagram. The firewalls are PA5220. The router is Cisco ASR1001.

Thanks.

[BPry]

@tinhnho,

Is there a compelling reason to continue to utilize v-wire? Outside of initial PoC deployments I personally don't recommend keeping things deployed as a v-wire deployment.

[tinhnho]

Hi BPry, The main reason was that I wanted to get visibility on the router's outside interfaces and be able to apply security profiles to these Vwire interfaces. 

[tinhnho]

I'd be curious, if you could elaborate more on why you don't recommend using vwire in this specific case except PoC.