Deploy PA firewall HA in different availability zone in Azure

[alextsa]

Hi all

Understand PA HA deployment supported since PAN-OS 9.0, so firewall pair can be deployed in the availability set so they are in different hardware cluster in Azure. But may I know anyone tried to form the HA in different availability zone in the same Azure region? Support or not?

Best regards

Alex Tsang 

[ssyed]

We recommend deploying firewalls in separate AZs or at least put them into an Availability Set in Azure.  HA mode is supported as well but not typically recommended.  The load balancer method is recommended.  You can see both setups in our reference architecture guide.  https://www.paloaltonetworks.com/resources/guides/azure-architecture-guide

[JimMcGrady]

From what i can see, the issue is that the VM-series firewall available from Azure Marketplace does not facilitate choosing an Availability Zone. And once the firewall is created, there is no reasonable way to move it into an AZ.

[raji_toor]

I would also like to know how to install it as the only method of deployment in Azure I know of is through marketplace..

Or is there some kind of ovf file provided which we can use for installation.

[tostern]

Good morning @raji_toor and @JimMcGrady 

The Azure Marketplace offering has limited features and you can't deploy two firewalls over the marketplace in a single Ressource Group.

That why we are using Terraform templates or ARM templates. Below are the link to the ARM Templates with the examples how to use it.

ARM Templates: https://github.com/wwce/azure-arm

Terraform provider: https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/azurerm/latest

How to setup HA in Azure: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/set-up-the-vm-series-firewall-...

i hope i could help you.

Regards,

Torsten