I want to get your opinion on a case I have it below and want to know the best scenario/Practice for the design.
What is the Best Mechanism to trigger the failover between Palo alto and Meraki MX. What i meant, when Palo alto 1` is down, how the MX1 will know that Palo alto 1 is down and he needs to communicate with palo alto alto #2.
Solved! Go to Solution.
I'm with @jdsilva . It looks like a terrible idea to me. I can't imagine what the benefit of such a huge amount of complexity will be.
You can be pretty confident that engineering in so much complexity will result in an increased number of outages.
The Palo Alto Firewall is a must and they have features that are not available with Meraki MX, So we have to keep them and they are Managed by different organizations ( 3rd party), and the Meraki is managed by another Organization, So we have to keep them in parallel.
I totally understand the design is complex and I am in a situation I have to simplify the solution and keep both of them MX/Palo Alto
Please see below the Overall Design.
So what I am asking is how to simplify the Failover Mechanism between two Different Vendors with the Above Design.
Any Idea you can share it with me?
I don't see the issue, if you have two HA pairs that can't be in series, then what you have is what you need. We've had a similar setup for years and never had any issues, it just works.
For those that need to know, we have HA pairs from two different vendors and run VPNs from both, traditionally one with the site to site and the other with the primary client VPN. We did briefly have three HA pairs in parallel, but that was just too much 🤣
What traffic do you want to go to what firewall cluster, and which is the primary firewall cluster (Palo Alto or Meraki)?
I think the diagram is very confusing with the voice VLAN appearing to go to what I assume are the MXs and then not really anywhere.
You have Azure on a LAN interface on the Palo Altos and a WAN interface for unknown traffic. As @PhilipDAth said, what are you trying to achieve, why do you want the MXs, is it just for the voice traffic, and if so goes much voice traffic do you have that requires dedicated MX hardware? We use Cisco ISRs for SIP trunk termination as they have hardware resources for transcoding etc.