1. Home
    2. CN-Series
    3. Version 11.0
    4. CN-Series Deployment Guide
    5. Secure Kubernetes Workloads with CN-Series
    6. Deploy the CN-Series Firewalls
    7. High Availability for CN-Series Firewall on AWS EKS
    8. Overview of HA on AWS EKS

    Overview of HA on AWS EKS

    To ensure redundancy, you can deploy the CN-Series firewalls on AWS in an active/passive high availability (HA) configuration. The active peer continuously synchronizes its configuration and session information with the identically configured passive peer. A heartbeat connection between the two devices ensures failover if the active device goes down. You can deploy the CN-Series firewall on AWS EKS in HA through Secondary IP move.
    To ensure that all traffic to your internet-facing applications passes through the firewall, you can configure AWS ingress routing. The AWS ingress routing capability allows you to associate route tables with the AWS Internet gateway and add route rules to redirect the application traffic through the CN-Series firewall. This redirection ensures that all internet traffic passes through the firewall without having to reconfigure the application endpoints.

    Secondary IP Move

    When the active peer goes down, the passive peer detects this failure and becomes active. Additionally, it triggers API calls to the AWS infrastructure to move the configured secondary IP addresses from the dataplane interfaces of the failed peer to itself. Additionally, AWS updates the route tables to ensure that traffic is directed to the active firewall instance. These two operations ensure that inbound and outbound traffic sessions are restored after failover. This option allows you to take advantage of DPDK to improve the performance of your CN-Series firewall instances.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2023 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo