HA Configuration with network provider router

[JeromeC]

Hello

In case where I haven't switch between network provider router and our cluster of Palo Alto (Active/Passive), only a cable between router (eth1) and Eth1 of Active firewall, if the active FW is broken, the communication will be cut or not ? 

What is the best design to connect a sigle router of network operator to our FW cluster if we can dedicated a switch between router and FW ?

BR

[Adrian_Jensen]

Yes, if the active PA fails the network will be cut off. You need a switch to link the active and passive external interfaces to the network provider router. Or get the network provider to bridge 2 ports together on their router.

 You show that your active/passive are connected to a VLAN on the internal network. Another possibility would be to create another VLAN on your existing internal switch and use that VLAN to bridge the active/passive external interfaces to the network provider router. If you are extremely short on switch ports you could even put the internal and external VLANs on the same physical ports (one switchport to each PA) and the external VLAN to the network provider.