Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

L1 Bithead

Hi All,


We have 2 Palo Alto VM firewalls (A: Primary & B: Secondary) deployed in Active/Passive mode for high-availability. These firewalls are deployed in Azure cloud and have multiple site to site IPSEC VPN tunnels configured with multiple vendors. Recently, we faced an issue when we were performing PAN OS upgrade on both the firewalls.


After we upgraded secondary firewall B, we failed over the traffic from A to B so that we can upgrade A:Primary one, the failover happened successfully from A to B but the floating IP did not move from A to B. Hence, we had to roll back the changes as external IP remained on suspended firewall A: Primary and VPN tunnels went down which led to outage. So, as a resolution we had to manually attach the floating IP from firewall A to firewall B, which became active after manual failover.


Can someone please help me in below,


1. How can we avoid the situation so that floating Ip moves whenever there is failover triggered between Active & Passive for Palo Alto VM firewalls in Azure?

2. How can we setup monitor for external public IP which is attached to the floating IP in Azure so that we know that VPNs with multiple vendors are up and running fine?

3. What is the best architecture design solution for site to site VPN tunnels setup configured in Palo Alto VMs in Azure?


Thanks & Regards,




L1 Bithead

@djr / @SebRupik , can you please help me here, any suggestions?

L4 Transporter

I'm afraid I can't help with this, I don't have experience of VM Palos in cloud environments, sorry.

L1 Bithead

@reaper , any suggestions for my query. 

Cyber Elite
Cyber Elite

for 1. i'd use 2 standalone VMs with loadbalancing instead of a HA cluster

2. there's monitoring tools in azure for that

3. if you go with the standalone VMs you can setup 2 tunnels and use these for failover (pbf/bgp/...)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 4 replies
  • 85 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!