Small office requirement

1. Set up PaloAlto1 and 2 to be active passive HA.
2. Set up SW5 and SW6 as HSRP routers, vlan 100 towards the external and vlan 10 towards the internal.
3. HSRP for vlan 10 and vlan 100.
4. SW4 is a pure layer 2.
5. PaloAlto HA must have NAT for internet

Configuration will be configured from Win7, R is an out of band switch for managing the devices.

Palo Alto limitation

the VM edition of PA has some limitation as compared to its appliance counterpart.

1. The VM does not support aggregate ethernet group (lacp).
2. Does not support multi-vsys.
3. Only supports active-passive HA.
4. Only HA1 (control link) and does not have HA2 (data link) as compared to the appliance.

PaloAlto1 and 2 mgmt interface

both firewall will have the same mgmt ip address as shown above. The first step is to set the mgmt interface and use the web user interface to configure. Palo Alto has a very well design web user interface which makes configuration much easier than its command line counterpart.

Do the same for PaloAlto2:

Configuring Palo Alto active-passive failover

Assign eth1/1 and eth1/2 for HA.

Network > Interfaces, then click on eth1/1

Then click on eth1/2 and select HA. The end result looks like below.

Then configure the HA configuration by clicking on Device > High Availability.

Click on the “gear” icon on Setup.

Set to group 1, both peers must be in the same group.

The default HA1 port is management port, however for this scenario the port has to be changed to eth1/1, and eth1/2 will be the backup port.

I want PaloAlto1 to be the active firewall in the HA setup, lower priority wins the active election, if both firewall has the same priority the lowest mac address will be elected.

Similar steps will be applied for PaloAlto2, there are some slight difference like the HA1 and its backup ip address and the election settings priority will be the default. Preemptive have to be enabled on active and passive firewall for the active role take over.

We can verify the HA configuration by going to the Dashboard and enabled the high availability widget.

As shown above the HA has been successful.

 

Setting up routing for PaloAlto1 and 2

The configuration is done only on PaloAlto1 which is the active firewall.

Define which interfaces are layer3.

Network > Virtual Routers

Before creating the virtual router, you need to assign interfaces as Layer3.

Select eth1/3 and create subinterface for vlan 100. This subinterface will be the gateway for vlan 100. Vlan 100 is the transit network.

Create a virtual router, add the layer3 interfaces assigned just now.

We need two static routes, 1st is a default route going towards internet and the other south-bound towards Win8.

 

 

 

 

 

 

 

 

Defining zones

Make eth1/3 as intranet and eth1/4 as internet zones.

 

 

Set up NAT for 192.168.x.x to go to internet

Click on Policies and NAT.

Commit the entire changes.