About craigpaolozzi

or i could fully mesh alll 4 Palos and have two sets of static routes.....but you suggest going via the switch? ... View more

Cool will setup L3 sub interfaces, and tag the vlan to the correct access vlan defined on the switch  ... View more

Great, thanks for the advice BTW,   I should be able to keep the interface on the Palo Alo set as Layer 3 shouldnt i?   Or will I have to change to a L2 interface ? I need to be able to have a IP address on the interface for the static routing.   L2 VLAN, vlan id 555 for example, and all 4 ports will sit in that VLAN. ... View more

Thanks for that, so I  will use the Management ports. Yep we are waiting for training costs,    I would manage both pairs via the management address from Panorama? ... View more

Another quick question sorry...   In PA Active/ Passive - they share the same interface IP's (except the management ports)   In a Cisco ASA world, if I wanted to logon to the Passive member, I could do by using the Standby address of the firewall.  But in Palo Alto world that's not possible as interfaces don't have standby address.   I'm assuming the only way I can achieve the above is by using the management ports on each of the firewalls, then I can logon to the Passive node via the management IP.     We are going to be using Panorama too   ... View more

I may see if thats possible...but I doubt it.   very little traffic traverses the firewalls pairs.....syslog, snmp, icmp thats it basically.     ... View more

Yeah, thanks for clarifying. I propose to use a switch to connect the fw interconnects together. ... View more

Because the active node in the latest diagram I sent only has a link to the passive node, if that was in active mode it would be fine and would pass traffic. ... View more

Heres another of the situation I want to aviod;   if the active FW in the bottom pair wants to send traffic north, it will send via the passive not - which will fail And if HA2 doesnt send the traffic to the active pair....then still the traffic is dropped   ... View more

  Heres a better diagram of the full solution......so this is for an OT environment so sensitive networks. So there are networks behind the Inner Palo Alto pair.....they will be accessed by the Cisco LAN behind the Outer Pair of Palo Altos   ... View more

Thanks for the replies   Ideally yes I would of used a single ha pair of 820s instead of a back to back pair.  But our customer has already purchased them and have asked us to design them basically 😞   So the plan was to use a /30 between both Firewalls, since the Palo altos share the same IP address on the interfaces when in active passive mode.   The idea of putting a switch in the middle would be so the firewalls don't send packets to the passive Firewall as it will drop traffic.   So I would take both FW interconnect ports from both pairs (4 ports in total) and patch them into a new L2 vlan, then when the Firewalls arps for the address that's in the routing table it will respond with the correct active address instead of the possibly one of the active nodes paseses traffic to a passive node and will be dropped.     Does that make sense?     ... View more