Use Case: Configure Active/Active HA with Route-Based Redundancy
Focus
Focus
Next-Generation Firewall

Use Case: Configure Active/Active HA with Route-Based Redundancy

Table of Contents

Use Case: Configure Active/Active HA with Route-Based Redundancy

Learn how to configure active/active HA with route-based redundancy.
Where Can I Use This?What Do I Need?
  • NGFW (Managed by Strata Cloud Manager)
  • NGFW (Managed by PAN-OS or Panorama)
For Strata Cloud Manager managed NGFWs:
  • Strata Cloud Manager Pro
Route-based redundancy enables you to implement high availability configurations using dynamic routing protocols instead of traditional floating IP addresses. When you deploy this approach, each device in your HA pair maintains its own unique IP address on the Layer 3 network and uses protocols like OSPF or BGP to advertise routes and manage traffic distribution. You can leverage this method to create active-active deployments where both devices simultaneously process traffic, providing automatic load distribution and seamless failover capabilities when device or link failures occur.
Consider implementing route-based redundancy when you need scalable high availability solutions that can adapt to complex network topologies without the limitations of shared IP addressing schemes. This approach becomes particularly valuable when you require load sharing capabilities to improve network performance and resource utilization across your HA pair. You will find route-based redundancy especially beneficial in environments where asymmetric routing is acceptable or desired, as traffic can enter through one device and exit through another without disrupting operations.
You might choose route-based redundancy over other active/active HA methods when you want to eliminate single points of failure associated with floating IP addresses and when your network infrastructure already supports dynamic routing protocols. While this method requires more sophisticated configuration and troubleshooting skills compared to simpler HA setups, you gain the advantage of automatic traffic rerouting and improved network resilience.
The following Layer 3 topology illustrates two PA-7050 firewalls in an active/active HA environment that use Route-Based Redundancy. The firewalls belong to an OSPF area. When a link or firewall fails, OSPF handles the redundancy by redirecting traffic to the functioning firewall.
  1. Configure Active/Active HA.
    Perform Step 1 through Step 15.
  2. Configure OSPF.
    See OSPF.
  3. Define HA failover conditions.
  4. Commit the configuration.
  5. Configure the peer firewall in the same way, except in Step 5, if you selected Device ID 0 for the first firewall, select Device ID 1 for the peer firewall.