As dill mentions, be sure your use case is one for the Active/Active cluster. These add a significant complexity to the deployment. They are NOT about adding capacity. A cluster is there so primarily so that if one firewall fails traffic will still fully flow. This means that even in an active/active deploy EACH firewall should be able to carry the full load of traffic. The primary use case for Active/Active is when the network design requires permitting asymmetrical traffic flow. The secondary use case is where dynamic routing protocol peers must be maintained through the inactive firewall for the network design failover. If you don't need these conditions, then deploy in active/passive mode. And when you open tickets even if you meet these approved use cases, you will spend the first part of every conversation up the support chain justifying the Active/Active deploy is necessary. So be sure that it is. With the ssl and site-to-site vpn you do need to use floating ip for the failover and operation to work. You cannot use arp load sharing and maintain a tunnel end point. Have a look at the active/active tech note for the details, this is old but still the most complete document on the topic. Note how the configuration of nat, session handling and session ownership are handled in the Active/Active cluster. Configuring Active/Active HA PAN-OS 4.0
... View more
