05-19-2026 10:26 PM
Hello Guys,
I am trying to configure Active-Passive (A/P) HA failover for Palo Alto VM-Series firewalls in AWS.
I have completed the HA configuration and updated the required IAM roles and permissions. Currently, the setup is partially working as expected:
Primary Public IP (EIP) successfully moves from Passive ENI to Active ENI during failover.
Route tables are also getting updated correctly after failover.
Traffic connectivity is working fine after failover.
However, I am facing an issue when using multiple UNTRUST interfaces.
Scenario:
I created additional UNTRUST NICs/ENIs.
Assigned separate Public IPs/EIPs to those ENIs for hosting different applications/services.
During failover, only the first UNTRUST interface Public IP moves to the Active firewall.
The additional UNTRUST ENI Public IPs are not moving to the Active instance.
Requirement:
I need multiple UNTRUST NICs, each with its own Public IP/EIP, and all those EIPs should fail over automatically to the Active firewall during HA failover.
Current Environment:
PAN-OS Version: 12.1.4-h5
AWS Plugin Version: 6.1.2-h1
Has anyone implemented a similar design or faced this issue before? Any guidance or recommended configuration changes would be greatly appreciated.
Thank you in advance for your support.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
