About TomKisiel

I have an Palo Alto A/A HA configuration, each member with their own independent virtual router. The HA firewalls build an IPSEC tunnel to a branch Palo Alto firewall and have OSPF configured to advertise the HA firewall routes to the branch firewall, and the branch firewall to advertise it's local connected routes back to the HA firewalls. All firewalls are in area ID 0.0.0.0.   Everything works as expected, except for one issue. HA firewalls advertise to the branch firewall, firewall advertises back to the HA firewalls, but for some reason the HA firewall routes advertised to the branch end up on each HA firewall too: Screenshot is a snip of a route to specific network on HA firewall A. First route is the local connected route, but the second route in the list is being learned from HA firewall B and incorrectly forwards traffic over the IPSEC tunnel interface (172.17.3.2).   Here is a snip from OSPF LSDB on HA firewall A 10.61.24.10. It should only be learning routes from branch firewall 10.52.24.10, not from HA firewall B 10.63.24.10   How can I stop the HA firewalls from learning OSPF routes being advertised by the partner firewall? Seemingly the unwanted advertised routes are being sent back from the branch firewall, but area route suppression has not made a difference.   ... View more