Palo Alto VM series deployment in Azure Cloud

[KunhipockerShabeebEdu]

Hello Everyone,

We are planning to deploy two VM series firewalls in our Azure landing zone.

In our case, Palo Alto firewall is like a data center firewall and we have a Fortigate in the perimeter.

• All outbound traffic from cloud servers will hit the Palo Alto first and then move to the Fortigate and then to the internet.
• All inbound traffic to cloud servers should hit the Fortigate first and then move to the Palo Alto and then to the cloud server.
• Public IPs will be present on the Fortigate and not on the Palo Alto

When I checked the design options I have seen 2 options as given below.

1. Active/Passive

• Good for config sync and session sync. But I read people mentioning about the longer failover time.

2. Standalone deployment with load balancers

• No config sync or session sync
• Requires Panorama for configuration management
• Faster failover time.

Which one should I choose?. I would like to know which option is mostly deployed. 

Thanks in advance

[KunhipockerShabeebEdu]

Any update guys?.