About QuangLe

Hi @BPry thank you for provide very helpful information. 2) If i go with HA pair Active-Active, can i use 1 Gbps Fiber link for HA1, HA2, HA3 ? 3) That ok, i only use Layer 3 Deployment, 4) Yes, currently i don't have Panaroma.   Yes, currently i only use static route. Dynamic is really not needed in my case because i ony have 2 default route to 2 GW with difference priority. ... View more

Hi @grenzi , yes you're right. That exactly what i looking for. I don't know how many ip it need for each cluster interface pair. how it load balance or take over in case one firewall down. The document give us no information. ... View more

Hi @BPry this is the current firewall topology i have with 2 Check Point firewall and it will be replace with 2 PA 5250. With Check Point Cluster it can be Active Ative or Active Passive base on your decision. And each firewall stay in a difference DC. Let say FW1 place at DC1 and FW2 place at DC2. DC1 and DC2 is in the same city but still far form each other. The sync interface between 2 firewall is 1Gbps Fiber cable connect between 2 DC. Now when deploy new PA firewall, if using HA pair i'm not sure HA1, HA2, HA3 can use 1Gbps link or it have to be 10Gbps link which not available to me right now. So i decide to use HA Cluster where HA4 can use 1Gbps link, it also design for HA between 2 DC.  But i have no idea how it work, it will have a virtual IP between two cluster member like Check Point Cluster or else. Please help share with me about this. Thank you.   ... View more

Hi @BPry , Thank you for reply me. Let me send you an example. In current network topology, it look pretty similar to this. And I think you misunderstand something here @BPry . Because with HA Cluster, there is no Passive. All member is always Active but they can also be a part of HA Pair where we have Passive. You can check this document. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/high-availability/ha-clustering-overview.html   This HA Cluster only just appear from PAN OS version 10 so I have no idea about this. ... View more