For background, here is the scenario: Initially we were looking at a high availability setup with 2 VM appliances, however, there is a restriction to a single AZ in that approach because of how the “floating IP / ENI” works. However, this environment will span multiple AZ’s for redundancy and there is a published Palo Alto video on how they do this: https://www.youtube.com/watch?time_continue=130&v=xiPZHzdNRmI I’m re-watching it again, but based on my setup of the initial PA devices here is what I think I’m seeing: It looks like the configuration is being sync’d not through native PA HA config sync features, but through the cloud formation (CF) template and scripting It looks like they may be using CF to set the necessary AWS routing to support egress filtering I just want to confirm this is the case so we roughly have an understanding of how we’ll how to build this out. Thanks,
... View more