Configure HA Devices for SD-WAN

Configure Active/Passive HA for two SD-WAN branches or hubs.
You can configure two firewalls as a branch in active/passive HA mode (or two firewalls as a hub in active/passive HA mode) to be part of your SD-WAN environment. In this case, Panorama™ needs to push the same configuration to the active peer and the passive peer, rather than treat the two firewalls individually. To make that happen, you configure active/passive HA before adding the devices for SD-WAN, so that Panorama is aware the devices are HA peers and pushes the same configuration to them. (Only HA active/passive mode is supported.)
Read through the following procedure before you begin so you don’t Commit after adding your HA peers as SD-WAN devices.
In HA, the firewall does not synchronize SD-WAN session distribution statistics. After an HA failover, the session distribution statistics display only statistics of new sessions; statistics of existing sessions are lost.
  1. Before you enable SD-WAN on your HA peers, configure Active/Passive HA on two firewall models that support SD-WAN.
  2. Add the HA peers as SD-WAN devices,
    but don’t perform the last step to Commit
  3. In Panorama, select
    Managed Devices
  4. At the bottom of the screen, select
    Group HA Peers
    . Confirm that under the Status display, the HA Status column includes the two firewalls, one Active and one Passive. Panorama is aware of the HA status and will push the same SD-WAN configuration to the two HA peers when you commit.
  5. Commit
    Commit and Push

Recommended For You