This lab guide focuses on Palo Alto active-passive HA as an operational problem: how the pair synchronizes, what the network should do during a failover, and how to verify the result without relying on the GUI alone.<\/p>\n
Implementing a Palo Alto active passive HA configuration<\/strong> solves this issue. It pairs two firewalls so that one actively processes traffic while the second remains in a standby state. The standby node continuously mirrors session state and configuration data. If the primary unit fails, the secondary firewall takes over instantly without dropping active connections.<\/p>\n Acme Financial operates a primary data center hosting mission-critical banking portals and transactional databases. The infrastructure relies on two firewall appliances to inspect north-south internet traffic and east-west internal segment traffic.<\/p>\n To comply with financial industry uptime SLAs, Acme Financial requires zero single points of failure across their security edge. They require:<\/p>\n The following diagram illustrates the physical and logical layout of the active-passive high availability cluster. dedicated physical connections link the two firewalls directly for control (HA1) and data (HA2) synchronization.<\/p>\n The following table details the IP addressing layout, interface assignments, and HA cluster parameters used throughout this lab guide. Note that public IPv4 addresses use RFC 5737 test ranges, and local IPs use standard private documentation subnets. Adapt these values to match your specific deployment plan.<\/p>\n Before pairing two Palo Alto Networks firewalls in an active-passive HA cluster, confirm that both appliances meet strict compatibility requirements. Mismatches can prevent session state synchronization or block HA cluster formation altogether.<\/p>\n Follow these steps to configure high availability on both firewalls using the PAN-OS web interface. Perform these steps on both devices, modifying device-specific parameters like IP addresses and priorities where indicated.<\/p>\n On appliances lacking dedicated HA ports (or when using standard data ports for HA2), set the interface type to HA.<\/p>\n Configure general HA settings, election parameters, and device priorities. Lower priority numbers indicate a higher preference for the Active role.<\/p>\n Now perform the same steps on FW-B<\/strong>, but set the election settings differently:<\/p>\n Configure the transport settings for control plane communications (HA1) and state table replication (HA2).<\/p>\n Configure FW-B<\/strong> with matching settings, using IP address Link and Path monitoring track physical interface states and remote IP reachability. If a monitored link fails, the active firewall triggers an automatic failover to the passive peer.<\/p>\n You can also complete high availability status checks, configuration pushes, and forced operational failover tests directly through the PAN-OS Command Line Interface (CLI).<\/p>\n Review current HA operational status and peer cluster health:<\/p>\n Check the physical and logical condition of the HA control link (HA1) and data link (HA2):<\/p>\n Force a running firewall to initiate a configuration sync to its passive peer:<\/p>\n To suspend an active unit and force traffic over to the passive peer during testing:<\/p>\n To restore a suspended unit back to normal functional operation:<\/p>\n Understanding packet processing mechanics across an active-passive firewall pair is essential for effective troubleshooting and design validation.<\/p>\n Validate your Palo Alto active-passive HA configuration using the following operational checks.<\/p>\n Log into the web UI of FW-A<\/strong> and check the High Availability<\/strong> dashboard widget on the main screen. You should confirm:<\/p>\n To verify continuous, hitless failover under simulated failure conditions, run a continuous ping test from an internal workstation toward an external host (such as While the ping runs, open the CLI on FW-A<\/strong> and suspend the active firewall state:<\/p>\n Observe the continuous ping output. A properly optimized active-passive HA setup should experience no more than 1 to 2 dropped ping packets<\/strong> during the cutover process. Verify on FW-B<\/strong> that its HA status switches to Active:<\/p>\n Re-enable FW-A<\/strong> back into service after completing the test:<\/p>\n If your high availability pairing fails to form, or if state synchronization breaks, work through these targeted troubleshooting procedures.<\/p>\n When preparing to deploy high availability in live enterprise environments, consider these recommended practices:<\/p>\nReal-Life Scenario<\/h2>\n
\n
Lab Topology<\/h2>\n
\n +-----------------------+\n | Upstream ISP \/ |\n | Edge Routers |\n +-----------+-----------+\n |\n +------------------+------------------+\n | |\n | Port ethernet1\/1 | Port ethernet1\/1\n +----------+----------+ +----------+----------+\n | FW-A (Active) | | FW-B (Passive) |\n | PA-3220 | | PA-3220 |\n | | HA1 Control | |\n | HA1-A Port +---------------+ Port HA1-A |\n | | 192.168.1.1\/30| |\n | | 192.168.1.2\/30| |\n | HA1-B Port + - - - - - - - + Port HA1-B |\n | | (Backup Link)| |\n | | | |\n | HA2-A Port +---------------+ Port HA2-A |\n | | 192.168.2.1\/30| |\n | | 192.168.2.2\/30| |\n +----------+----------+ +----------+----------+\n | Port ethernet1\/2 | Port ethernet1\/2\n | |\n +------------------+------------------+\n |\n +-----------+-----------+\n | Internal Core |\n | Switch Fabric |\n +-----------------------+\n<\/pre>\n
Example Addressing and Objects<\/h2>\n
\n\n
\n \nDevice \/ Role<\/th>\n Interface \/ Parameter<\/th>\n IP Address \/ Value<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n \n FW-A (Primary)<\/strong><\/td>\n Management Interface<\/td>\n 192.0.2.10\/24<\/td>\n Out-of-band management IP for FW-A.<\/td>\n<\/tr>\n \n FW-B (Secondary)<\/strong><\/td>\n Management Interface<\/td>\n 192.0.2.11\/24<\/td>\n Out-of-band management IP for FW-B.<\/td>\n<\/tr>\n \n HA Cluster<\/strong><\/td>\n HA Group ID<\/td>\n 10<\/td>\n Must match on both firewalls (Range: 1-63).<\/td>\n<\/tr>\n \n HA Control Link<\/strong><\/td>\n HA1 (FW-A \/ FW-B)<\/td>\n 192.168.1.1\/30 & 192.168.1.2\/30<\/td>\n Dedicated control plane sync link.<\/td>\n<\/tr>\n \n HA Control Backup<\/strong><\/td>\n HA1-Backup (FW-A \/ FW-B)<\/td>\n 192.0.2.10 & 192.0.2.11<\/td>\n In-band management fallback for control traffic.<\/td>\n<\/tr>\n \n HA Data Link<\/strong><\/td>\n HA2 (FW-A \/ FW-B)<\/td>\n 192.168.2.1\/30 & 192.168.2.2\/30<\/td>\n Dedicated data plane session sync link.<\/td>\n<\/tr>\n \n Untrust (WAN)<\/strong><\/td>\n ethernet1\/1 (Floating IP)<\/td>\n 198.51.100.10\/24<\/td>\n Virtual\/Floating IP assigned to Active firewall.<\/td>\n<\/tr>\n \n Trust (LAN)<\/strong><\/td>\n ethernet1\/2 (Floating IP)<\/td>\n 203.0.113.1\/24<\/td>\n Default gateway floating IP for internal hosts.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Prerequisites<\/h2>\n
\n
Step-by-Step GUI Configuration<\/h2>\n
Step 1: Configure Physical Interfaces for HA Use<\/h3>\n
\n
ethernet1\/3<\/code>).<\/li>\nStep 2: Enable High Availability and Set Election Rules<\/h3>\n
\n
10<\/code>.<\/li>\nActive-Passive<\/code>.<\/li>\n100<\/code> (FW-A will be preferred Active).<\/li>\n\n
10<\/code>.<\/li>\n200<\/code> (Higher number means lower preference).<\/li>\n<\/ul>\nStep 3: Configure Control (HA1) and Data (HA2) Links<\/h3>\n
\n
ha1-a<\/code> or dedicated port).<\/li>\n192.168.1.1<\/code> and Netmask<\/strong> to 255.255.255.252<\/code>.<\/li>\nethernet1\/3<\/code> or ha2-a<\/code>).<\/li>\n192.168.2.1<\/code> and Netmask<\/strong> to 255.255.255.252<\/code>.<\/li>\nEthernet<\/code> or IP<\/code> (Protocol 99) based on your network architecture. Select IP<\/code> if HA2 traffic passes through L3 infrastructure.<\/li>\n192.168.1.2\/30<\/code> for HA1 and 192.168.2.2\/30<\/code> for HA2.<\/p>\nStep 4: Configure Link and Path Monitoring<\/h3>\n
\n
Uplink-Monitor<\/code>), set Failure Condition<\/strong> to any<\/code>, and add critical interfaces such as ethernet1\/1<\/code> and ethernet1\/2<\/code>.<\/li>\nCLI Section<\/h2>\n
admin@FW-A> show high-availability state\nadmin@FW-A> show high-availability all\n<\/code><\/pre>\nadmin@FW-A> show high-availability link-monitoring\nadmin@FW-A> show high-availability path-monitoring\n<\/code><\/pre>\nadmin@FW-A> request high-availability sync-to-remote\n<\/code><\/pre>\nadmin@FW-A> request high-availability state suspend\n<\/code><\/pre>\nadmin@FW-A> request high-availability state functional\n<\/code><\/pre>\nHow the Traffic Flows<\/h2>\n
Normal Operations (Active Unit Handling Traffic)<\/h3>\n
\n
Failover Event Sequence<\/h3>\n
\n
Passive<\/code> to Active<\/code>.<\/li>\nVerification<\/h2>\n
1. Check HA Cluster Status in GUI<\/h3>\n
\n
\n+-------------------------------------------------------+\n| High Availability |\n+-------------------------------------------------------+\n| Local State: Active |\n| Peer State: Passive |\n| Running Sync: Synchronized |\n| Mode: Active-Passive |\n| Control Link: Up |\n| Data Link: Up |\n+-------------------------------------------------------+\n<\/pre>\n
2. Perform a Manual Failover Test<\/h3>\n
8.8.8.8<\/code> or an upstream gateway IP):<\/p>\nC:\\> ping -t 8.8.8.8\n<\/code><\/pre>\nadmin@FW-A> request high-availability state suspend\n<\/code><\/pre>\nadmin@FW-B> show high-availability state\n\nGroup 10: \n Mode: Active-Passive\n Local Information:\n State: Active\n Device Priority: 200\n Peer Information:\n State: Suspended\n Device Priority: 100\n<\/code><\/pre>\nadmin@FW-A> request high-availability state functional\n<\/code><\/pre>\nTroubleshooting<\/h2>\n
Symptom 1: HA Peer State Shows “Non-Functional” or “Mismatch”<\/h3>\n
\n
show system info<\/code>. Ensure App-ID, Antivirus, and WildFire versions match exactly under Device > Dynamic Updates<\/strong>.<\/li>\n<\/ul>\nSymptom 2: Split-Brain Condition (Both Firewalls Act as Active)<\/h3>\n
\n
show high-availability all<\/code> to inspect packet counters across the control interfaces.<\/li>\n<\/ul>\nSymptom 3: User Sessions Disconnect During Failover Events<\/h3>\n
\n
show high-availability state<\/code>. Ensure port speeds, duplex settings, and MTU match on both ends. Verify that firewall security policies do not accidentally block IP protocol 99 or UDP port 29281 if HA2 traffic crosses an intermediate network switch.<\/li>\n<\/ul>\nCommon Mistakes<\/h2>\n
\n
Production Considerations<\/h2>\n
\n