QuestionQ3

PAN-OS Networking Configuration

An organization is deploying VM-Series firewalls in Microsoft Azure to protect its VNets. A key requirement is for the security infrastructure to withstand the failure of an entire Azure Availability Zone.

What is the recommended approach to meet this objective?

  • A Deploy multiple, independent VM-Series firewalls in different Availability Zones and use an Azure Load Balancer to distribute traffic to them.
  • B Implement a Terraform configuration that automatically redeploys the firewall in a new zone if the original one fails.
  • C Use Azure Traffic Manager to direct traffic to a primary VM-Series firewall, with a second firewall in another zone as a failover target.
  • D Configure PAN-OS active/passive high availability (HA) between two VM-Series instances in separate Availability Zones using HA links over a VNet peering connection.
Explanation

Deploying independent VM-Series firewalls in separate Availability Zones behind an Azure Load Balancer provides resilience to an Availability Zone outage. The load balancer health-checks the instances and distributes traffic only to healthy firewalls, so loss of one zone does not eliminate the security path.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!