When deploying Palo Alto Networks NGFWs in a cloud service provider (CSP) environment, which method ensures high availability (HA) across multiple availability zones?

In public cloud environments (CSPs like AWS, Azure, and GCP), traditional Layer 2 high availability mechanisms (such as floating MAC addresses or gratuitous ARPs) are typically unsupported across different Availability Zones (AZs) due to underlying software-defined networking constraints. To achieve cross-AZ high availability, Palo Alto Networks recommends a load-balancer-based architecture. This involves deploying independent VM-Series firewalls across multiple AZs and utilizing cloud-native load balancers (e.g., AWS Gateway Load Balancer or Azure Standard Load Balancer). These load balancers use health probes to continuously monitor the status of each firewall instance. If a firewall experiences an outage, the health probe fails, and the load balancer automatically redirects traffic to healthy firewalls residing in other AZs, ensuring seamless redundancy and robust high availability.

A: Ansible is an automation and configuration management tool used for deployment, not a network mechanism that dynamically routes traffic or provides HA during failures. B: Terraform is an infrastructure-as-code tool. Additionally, this option explicitly limits redundancy to a single availability zone, directly contradicting the question's multi-AZ requirement. D: Traditional PAN-OS Active/Active HA clustering requires Layer 2 adjacency and dedicated HA links, which are architecturally restricted or unsupported across different AZs in public clouds.

1. Palo Alto Networks. (2023). VM-Series Deployment Guide. Section: "High Availability for VM-Series Firewall." This official documentation details how cloud-native load balancers and health probes are the validated design for achieving multi-AZ high availability, bypassing CSP Layer 2 limitations.

2. Palo Alto Networks. (2022). Reference Architecture: Securing Amazon Web Services. Section: "Inbound/Outbound Traffic Flows and Load Balancing." Explains the use of AWS Gateway Load Balancer (GWLB) and health checks to maintain HA across multiple AWS Availability Zones.

3. Palo Alto Networks. (2022). Reference Architecture: Securing Microsoft Azure. Section: "Multi-Zone High Availability." Describes the necessity of Azure Standard Load Balancers with TCP/HTTP health probes to route traffic around failed VM-Series instances across different Azure zones.