While deploying the VM-Series firewall in HA mode, you will need to ensure the following:

The VM-Series data interface is on the same shared subnet as the NLB we will provision later.
Allow IP Spoofing
is enabled on the VM-Series data interface (shared subnet with NLB) through the Network Interfaces page of the VPC VSI User Interface.
Health checks
for the VNF configuration is enabled from the NLB.

You can deploy an NLB using the UI, CLI, or REST API. For instructions on deploying an NLB, see Creating a route mode Network Load Balancer for VPC.

The VM-Series data network interface is attached to a VPC Security Group. While configuring the Security Groups, ensure that the Security Group has Inbound rules that allow traffic on the health port setup between the NLB and the VM-Series. For example, if the health check is set up for TCP on Port 80 (HTTP), then create an inbound rule under the same Security Group. Additionally, ensure that the rules are created to allow or restrict data traffic.

Custom routes are created to ensure that the ingress data traffic is routed through the NLB on its way to the VM-Series and target destination. In some cases custom routes may also be needed to ensure egress traffic is returned to the original client source. For more information, see About routing tables and routes.