🔁 Palo Alto Networks High Availability (HA) Overview and Troubleshooting Guide

1. Introduction to High Availability (HA)

High Availability (HA) in Palo Alto Networks firewalls ensures continuous network security by configuring two firewalls as an HA pair. This setup provides redundancy, minimizing downtime by allowing one firewall to take over if the other fails.

HA configurations can be:

• Active/Passive: One firewall actively manages traffic, while the other remains passive, ready to take over upon failure.
• Active/Active: Both firewalls actively manage traffic, providing load balancing and redundancy.

For more details, refer to the HA Overview documentation.

2. HA Components and Links

Key components and links in an HA setup include:

• HA1 (Control Link): Exchanges control information such as heartbeats and configuration synchronization.
• HA2 (Data Link): Synchronizes session and forwarding tables between firewalls.
• HA3 (Packet Forwarding Link): Used in Active/Active configurations for forwarding packets to the peer during session setup.
• HA1 Backup: Provides redundancy for the HA1 link.

Detailed information can be found in the HA Concepts guide.

3. Common HA Issues and Troubleshooting Steps

When encountering HA issues, consider the following steps:

• HA Link Failures: Check physical connections, ensure proper cabling, and verify that the correct interfaces are configured for HA links.
• Synchronization Failures: Use the CLI command show high-availability all to check synchronization status. If issues persist, consider manually syncing configurations using request high-availability sync-to-remote running-config .
• Split Brain Scenario: Occurs when both firewalls become active simultaneously. To resolve, suspend one firewall using the GUI or CLI command request high-availability state suspend and investigate the cause of the failure.
• HA Peer Connection Down: Review system logs for errors, verify HA configurations, and ensure that both firewalls are running compatible PAN-OS versions.

For a comprehensive list of troubleshooting resources, visit the High Availability Configuration and Troubleshooting page.

4. Best Practices for HA Configuration

• Ensure both firewalls are of the same model and PAN-OS version.
• Use dedicated HA ports for HA1 and HA2 links when available.
• Configure HA1 Backup links to provide redundancy for the control link.
• Regularly monitor HA status and logs to detect and address issues promptly.
• Test failover scenarios periodically to ensure HA functionality.

Additional best practices can be found in the High Availability documentation.