Best approach on connecting two PaloAlto firewalls pairs with different networks

[maan2004]

Hello,

I am a newbie in networking, hopefully my explanation is clear, so I do have a pair of PA 3260 running in Active\Passive configuration, with multiple Layer 3 interfaces and sub interfaces connected, each one of those interfaces is a security zone, and routing is handled automatically between the interfaces.

Now I want to connect the PA 3260 pairs to a PA 3020 pair that is also running Active\Passive configuration with different Layer 3 interfaces, similarly each in its security zone and routing done automatically.

my question is what is the best approach to have a connectivity between those two firewalls, and be able to create security policy between individual zones in PA 3260 and PA 3020.

[OtakarKlier]

Hello,

Are all the PAN's in the same location? What is the difference in traffic that each pair handle? Reason I ask, it might be easier to collapse the 3060 into the 3260 and retire the 3060 pair? I'm a huge fan of keeping things simple.

Regards,

[maan2004]

Thanks for your reply, Yes they are on the same room, things were separated as 3060 is handling some kind of operation traffic which has higher priority than the 3260, I guess kind of physical segregation and minimize downtime in hardware failure.