Redesigned an enterprise hub-and-spoke firewall architecture in Azure, migrating from a 2-node Active-Passive PAN-OS cluster across 4 network zones to a 3-node Active-Active-Active cluster behind an Azure Internal Load Balancer with a unified 2-zone model.
firewalls
2 → 3
zones
4 → 2
spoke next hops
3 → 1
Overview
A network infrastructure project modernising a production Azure NETHUB environment. The existing design used two PAN-OS firewalls in an Active-Passive HA pair with four discrete network zones (Outside, DMZ, Inside, Vendor) and per-zone floating IPs as next hops for all spoke VNETs. The new design replaces this with three PAN-OS firewalls running Active-Active-Active behind an Azure Standard Internal Load Balancer, collapsing to two zones and a single ILB next-hop IP for every spoke.
The ILB load balancing rule uses HA Ports (protocol: All, port: 0), which is what ensures 5-tuple flow symmetry for stateful inspection. Return traffic for a session always hits the same firewall that handled the forward flow. Standard per-port LB rules are not sufficient for a stateful firewall behind an ILB.
Azure NAT Gateway
Attached to the Outside subnet, NAT Gateway handles outbound internet SNAT at the Azure SDN layer for all three firewall outside interfaces. PAN-OS source NAT rules for internet-bound traffic are removed to prevent double-NAT.
Zone consolidation
The DMZ and Vendor zones are absorbed into a single Inside zone. All spoke VNETs regardless of their former zone classification now share one route table next-hop entry pointing to the ILB frontend IP, simplifying long-term route management from three maintenance surfaces to one.