Monitoring of external ip configured for vpn in Palo Alto vm firewalls deployed in Azure

[BilalM]

Hi All,

We have 2 Palo Alto VM firewalls (A: Primary & B: Secondary) deployed in Active/Passive mode for high-availability. These firewalls are deployed in Azure cloud and have multiple site to site IPSEC VPN tunnels configured with multiple vendors. Recently, we faced an issue when we were performing PAN OS upgrade on both the firewalls.

After we upgraded secondary firewall B, we failed over the traffic from A to B so that we can upgrade A:Primary one, the failover happened successfully from A to B but the floating IP did not move from A to B. Hence, we had to roll back the changes as external IP remained on suspended firewall A: Primary and VPN tunnels went down which led to outage. So, as a resolution we had to manually attach the floating IP from firewall A to firewall B, which became active after manual failover.

Can someone please help me in below,

1. How can we avoid the situation so that floating Ip moves whenever there is failover triggered between Active & Passive for Palo Alto VM firewalls in Azure?

2. How can we setup monitor for external public IP which is attached to the floating IP in Azure so that we know that VPNs with multiple vendors are up and running fine?

3. What is the best architecture design solution for site to site VPN tunnels setup configured in Palo Alto VMs in Azure?

Thanks & Regards,

Bilal

[BilalM]

@djr / @SebRupik , can you please help me here, any suggestions?

[djr]

I'm afraid I can't help with this, I don't have experience of VM Palos in cloud environments, sorry.

[BilalM]

@reaper , any suggestions for my query. 

[reaper]

for 1. i'd use 2 standalone VMs with loadbalancing instead of a HA cluster

2. there's monitoring tools in azure for that

3. if you go with the standalone VMs you can setup 2 tunnels and use these for failover (pbf/bgp/...)