We have 2 Palo Alto VM firewalls (A: Primary & B: Secondary) deployed in Active/Passive mode for high-availability. These firewalls are deployed in Azure cloud and have multiple site to site IPSEC VPN tunnels configured with multiple vendors. Recently, we faced an issue when we were performing PAN OS upgrade on both the firewalls.
After we upgraded secondary firewall B, we failed over the traffic from A to B so that we can upgrade A:Primary one, the failover happened successfully from A to B but the floating IP did not move from A to B. Hence, we had to roll back the changes as external IP remained on suspended firewall A: Primary and VPN tunnels went down which led to outage. So, as a resolution we had to manually attach the floating IP from firewall A to firewall B, which became active after manual failover.
Can someone please help me in below,
1. How can we avoid the situation so that floating Ip moves whenever there is failover triggered between Active & Passive for Palo Alto VM firewalls in Azure?
2. How can we setup monitor for external public IP which is attached to the floating IP in Azure so that we know that VPNs with multiple vendors are up and running fine?
3. What is the best architecture design solution for site to site VPN tunnels setup configured in Palo Alto VMs in Azure?
Thanks & Regards,
for 1. i'd use 2 standalone VMs with loadbalancing instead of a HA cluster
2. there's monitoring tools in azure for that
3. if you go with the standalone VMs you can setup 2 tunnels and use these for failover (pbf/bgp/...)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!