AWS Availability Zones

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

AWS Availability Zones

L1 Bithead

For background, here is the scenario:

 

Initially we were looking at a high availability setup with 2 VM appliances, however, there is a restriction to a single AZ in that approach because of how the “floating IP / ENI” works.

 

However, this environment will span multiple AZ’s for redundancy and there is a published Palo Alto video on how they do this: https://www.youtube.com/watch?time_continue=130&v=xiPZHzdNRmI

 

I’m re-watching it again, but based on my setup of the initial PA devices here is what I think I’m seeing:

 

  • It looks like the configuration is being sync’d not through native PA HA config sync features, but through the cloud formation (CF) template and scripting
  • It looks like they may be using CF to set the necessary AWS routing to support egress filtering

 

I just want to confirm this is the case so we roughly have an understanding of how we’ll how to build this out.

 

Thanks,

1 accepted solution

Accepted Solutions

Palo Alto Networks Guru

Hello,

 

You are correct, our PAN-OS stateful failover solution requires an interface move which cannot happen between subnets and subnets do not span AZs.


For AZ redundancy, we recommend the load balancer sandwhich covered in the video you referenced.  It doesn't track state between AZs but AZ failure is very rare and session restablishment for web based applications is usually transparent for the user.

 

Make sure you are using the latest template for the auto scaling solution: https://github.com/PaloAltoNetworks/aws-elb-autoscaling/tree/master/Version-1.2

 

HTH,


Warby

View solution in original post

3 REPLIES 3

Palo Alto Networks Guru

Hello,

 

You are correct, our PAN-OS stateful failover solution requires an interface move which cannot happen between subnets and subnets do not span AZs.


For AZ redundancy, we recommend the load balancer sandwhich covered in the video you referenced.  It doesn't track state between AZs but AZ failure is very rare and session restablishment for web based applications is usually transparent for the user.

 

Make sure you are using the latest template for the auto scaling solution: https://github.com/PaloAltoNetworks/aws-elb-autoscaling/tree/master/Version-1.2

 

HTH,


Warby

Hello,

 

I was investigating this issue. my problem is that I need cross AZ .  VPN+NAT

 

AWS speaking, I could move the EIP of the Trust interface to an ENI on another AZ. And then, update the route tables pointing to the second ENI. This will be with some downtime, which is acceptable as this is based on AZ failure, the other system behind my nat need to recover as well.

 

On paper, looks good. I'm wondering if there's a way to know with an external tool about the failure and initiate the failover process? and when the route is considered being down? no more ping? how about the WAN down and not the router?

 

Thanks

Please have a look at our reference architecture for AWS.

https://www.paloaltonetworks.com/resources/guides/intelligent-architectures-aws-reference-architectu...

 

We have several approaches to Fault Tolerance, most recently including the Transit Gateway.

  • 1 accepted solution
  • 7858 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!