Prisma SD-WAN - ION HA or Cold Spare?

[shawnmuas]

Looking at what others are doing for Prisma SD-WAN branch redundancy. We've narrowed it down to setting up IONs in HA or leaving a cold spare ION on site for disaster recovery. HA requires double licensing, which is pricey. Cold spare IONs don't require active licenses but the sites will experience longer downtime. IONs are easy enough to reconfigure with the included console cable and a laptop on a hotspot. The benefit of the cold spare is that the device will not be impacted by any power events, which Palo is saying is the problem with multiple ION2k outages we've experienced. The IONs are behind Eaton UPS but the WAN interfaces are not surge protected.

Just getting ideas. Thanks in advance.

[jpomachagua]

Hello @shawnmuas 

I would recommend assessing the criticality of the branch locations and the potential impact of the downtime. If downtime could significantly impact operations or create customer dissatisfaction, setting up IONs in high availability (HA) might be worth the investment, despite the associated licensing costs. On the other hand, if the branches can withstand longer downtime, leveraging a cold spare ION for disaster recovery could be a viable approach. 

Ultimately, the choice should align with the organization's risk tolerance, operational requirements, and budget constraints.

Regards

[BrewCity34]

I would agree with Jorge's comments.  We do run our ION's in HA.  For us, we wanted quick recovery for an outage and this was our design prior to SD-WAN. Prior to SD-WAN, we had multiple MPLS circuits at a branch and each circuit terminated to its own router.