About ScottF

Just to confirm... if an IP object belongs to a IP object group, and the IP object is not explicitly used in the ruleset, upon looking at unused objects within Expedition, that the IP object is still considered used as it belongs to a group that is used in a ruleset?  Furthermore, an IP object that belongs to a group in which the group is not referenced in a rule, that the IP address object is also considered unused (unless of course the IP object itself belongs to a group that is referenced in a rule).  This situation was not expressly answered in the any of the answers. ... View more

I'm assuming you are talking about a cluster in which both Palos share the same IP and both operate in an active/active fashion.  As many of you know when running in Active/Active, you actually have 2 IPs representing each virtual firewall group.  Half of your systems' gateways are configured for 1 IP and the other half to the other IP.  A true cluster would represent both firewalls by sharing a single IP and process traffic on both firewalls.  There are some inbedded technologies on systems that do this, but nothing I've heard on the Palos.  The only way I know of on how to do this is with the use of a load balanacer that sits in front and/or back of the firewalls.  The load balancer has the VIP or single IP and then routes to one of the firewall IPs that is running active/active.  The problem with this solution is that it is not fully redundant.  If you run in this fashion, you could have 75% on one firewall and 75% usage on the other.  If one firewall dies, then you would have 150% usage on one firewall (good luck with that) and you'll DoS your traffic and blow up the firewall in the process.  This is known as running in capacitive mode and not redundancy mode.  Granted you are running in high-availability, just not fully redundant.  This is why so many people run active/passive.  You are truely running N+1 in redundant mode as opposed to N+1/2 or something like that in capacitive mode.   There are articles on configuring load balancers to provide you the psuedo clustering you are looking for.  Good luck!   https://www.a10networks.com/resources/deployment-guides/a10-networkspalo-alto-networks-joint-firewall-load-balancing-solution   ... View more

The best way I've been able to do this is by having a different subnet at each location such as this: 10.10.1.0/24 and 10.30.1.0/24.  I create a L3-Interface on both firewalls and create the necessary routers.  I then created a rule in Panorama and applied it to both firewalls like so:  Trust=>RemoveOffices(10.10.1.0/24,10.30.1.0/24); App-ID: Any, Service: Any => Trust=>RemoteOffices(10.10.1.0/24, 10.30.1.0/24); App-ID: Any, Service: Any.  When applied to both sets of firewalls you'll get a psuedo VLAN extention.  To make it scale a little, create an Address Group named something like: VLAN1.  Then reference that in any rule you create.  You must always include Remote-Office (To and/or From) as appropriate.  This will allow all traffic originated on VLAN1 on site1 to VLAN1 on site2 (simulates an extended VLAN between sites).   I've used this and it works quite well.  The only gotcha you need to be careful of is when specifying the Interface between firewalls.  I use a dedicated Interface or Tunnel and keep my routes very specific only to the other site.  Any other routes should probably not traverse that link unless it absolutely needs to.   Good Luck! ... View more