About MarkTan

Hello, In a scenario with two palo alto firewalls where the active firewall fails over to the passive firewall, if there are IPSEC tunnels established are they suppose to automatically come up on the second firewall when the failover occurs or do we have to initialize them manually? If we wanted them to automatically come up, how would we do so? Can someone provide a configuration example? Thanks, Mark ... View more

Hello, We are currently building out our network infrastructure for a new office and have a question regarding the capabilities of the PA 3000 series firewalls. We want to use to be able to use two PA in high availability mode (active-passive) to do our routing, DHCP for different vlans, antivirus filtering, web filtering, vpn, potentially vlans, and active directory integration for the entire office. We will be implementing about 7 vlans (4 of them requiring DHCP); routing for an office of about 100 employees; internet connectivity for PCs, projectors, smart tvs, etc.; antivirus and other security features of the palo alto; ssl vpn; active directory integration for captive portal; and other items. Can anyone provide some insight on whether two PA 3000 firewalls will be able to handle this load? Also, if anyone has any ideas on the proper method to perform DHCP on 4 vlans via subinterfaces, that would be great. I assume that I define the layer 3 interface, create the subinterfaces with the proper tagged vlan, and then set up the DHCP pool tied to that specific subinterface? Thanks, Mark ... View more