HA GlobalProtect firewalls in Azure

[bxbukows]

I would like to deploy GP firewalls in Azure, I would like to configure 2 firewalls which are working active-active to have always some protection if one availability zone will have maintenance always second fw will handle the traffic. I was think to have 2 portals and 2 gateways, on 2 different Public IP which will be resolved on one DNS name. Did some one have similar configuration on Azure and deployed 2 Global Protect firewalls ? Or other solution which will cover HA in Azure for GP ?

[BorislavP]

Trying Active/Active HA in Azure for VM-Series — not the supported cloud pattern. Use A/P HA:

 https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/set-up-the-vm-series-firewall-...

[bxbukows]

Thanks BorislavP for your comment, A/P HA in Azure could take 3min to failover. I would like to setup 2 firewalls without additional interface for HA as on premises/hardware appliances. This will be regular Azure deployment with 2 firewalls and 3 interfaces, public , private and mgmt.

https://www.paloaltonetworks.com/resources/guides/azure-transit-vnet-deployment-guide

But cannot find any guide for GP firewalls in Azure

[BorislavP]

Even though there is no single guide, this design is fully covered by the following official Palo Alto Networks documents:

VM-Series on Azure (deployment only)

Set Up the VM-Series Firewall on Azure

https://docs.paloaltonetworks.com/vm-series/11-1/vm-series-deployment/set-up-the-vm-series-firewall-...

GlobalProtect – Multiple Gateways (this is the “HA guide”)

Configure Multiple GlobalProtect Gateways
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-quick-configs...

GlobalProtect Architecture overview
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-architecture

About GlobalProtect Gateways and Portals
https://docs.paloaltonetworks.com/globalprotect