NGFW HA on AWS with different AZ

[Amit_Sharma]

Hi All,

I want to configure Active/Passive HA on AWS, but both the PA-Instance should be in different AZ. How can we achieve this?

I have referred below article: https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-o...

In the above article it is not mentioned anything about AZ.

Suggest few options to achieve this.

[SutareMayur · Accepted solution]

Hi @Amit_Sharma ,

The document that you are following has mentioned the prerequisites regarding AWS AZ. It tells - 

• The HA peers must be deployed in the same AWS availability zone. 

Coming to Palo Alto HA configuration on AWS, the VM palo alto supports A/P HA configured within a single AWS AZ. A/P Palo Alto VM HA cannot span multiple Availability Zones due to the AWS limitation of not allowing ENI moves to span AZs. Kindly refer below article -

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClD9CAK 

Hope it helps!