professional-service-best-practices/terraform-paloalto-ha
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

change Readme

Browse source
This commit is contained in:
Michael_Sodan 2025-05-13 11:07:34 +02:00
parent f34aacce3c
commit 30d8c03919
1 changed files with 3 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
README.md
View file

@ -14,7 +14,7 @@ Two firewalls are deployed with identical network interfaces. A virtual IP (VIP)
### 🧷 Port Security & VIPs ### 🧷 Port Security & VIPs
- `port_security` **must be enabled** on interfaces where the **VIP** is active. - `port_security` **must be enabled** on interfaces where the **VIP** is active.
- **Do not attach** the VIP IP to any server or instance! - **Do not attach** the VIP interface to any server or instance!
- VIP must be added as an `allowed_address_pair` on **both firewalls'** relevant interfaces. - VIP must be added as an `allowed_address_pair` on **both firewalls'** relevant interfaces.
--- ---
@ -27,18 +27,6 @@ Two firewalls are deployed with identical network interfaces. A virtual IP (VIP)
--- ---
## 🔐 Configuration Rules
| Rule | Explanation |
|---------------------------------------------------|-------------|
| **Do NOT attach VIP IP to any VM** | The VIP is managed by the HA sync between the firewalls. |
| **VIP must be set with `/32`** | CIDR ranges are not supported for allowed addresses. |
| **VIP must be defined as `allowed_address_pair`** | On both firewalls where it can be active. |
| **Port security must be enabled** | On interfaces holding the VIP. |
| **Security groups must allow traffic for VIP** | If port security is enabled, define rules accordingly. |
---
## 🚧 Limitations & Notes ## 🚧 Limitations & Notes
- **VIP must not be attached to any instance** - **VIP must not be attached to any instance**
@ -62,4 +50,6 @@ Two firewalls are deployed with identical network interfaces. A virtual IP (VIP)
- **HA Sync and Preemption is not handled by Terraform** - **HA Sync and Preemption is not handled by Terraform**
The logic for state sync, failover, and preemption priorities must be configured manually in the firewall GUI or CLI. This project only provisions the infrastructure. The logic for state sync, failover, and preemption priorities must be configured manually in the firewall GUI or CLI. This project only provisions the infrastructure.
- **floating IP switch only possible with GARP**
Important: The Floating IP will only work correctly after the move if a Gratuitous ARP (GARP) is sent out — this ensures that the IP-to-MAC binding is updated on neighboring network devices.