Palo AltoConfig712 downloads

Palo Alto HA (Active/Passive or Active/Active)

High Availability configuration for Palo Alto PAN-OS firewalls: HA1 control link, HA2 data link, passive link state, preemption, and session synchronization.

↓ example.txt

What is it?

Palo Alto HA (High Availability) pairs two firewalls so that if one fails, the other takes over with no impact to active sessions. HA uses two links: HA1 (control link) synchronizes configuration, state, and routing tables between peers. HA2 (data link) synchronizes session tables — so TCP sessions survive a failover without clients noticing. Active/Passive mode is most common: one firewall processes all traffic, the other is in standby. Active/Active mode both firewalls process traffic but requires more complex routing.

When to use

·Any production internet-facing deployment — a single firewall is a single point of failure
·Environments requiring near-zero downtime for firewall software upgrades
·Compliance environments (PCI-DSS, HIPAA) that require redundant security controls
·Data centers where stateful failover (keeping TCP sessions alive) is required

When NOT to use

·Lab or development environments — HA adds configuration complexity
·Active/Active mode when you don't need the additional throughput — it's harder to configure and troubleshoot

How it compares

vs Cisco ASA FailoverASA uses 'Active/Standby' failover with a dedicated failover interface. Palo Alto HA uses HA1/HA2 dedicated interfaces for control and data sync. Both provide stateful session failover. PAN-OS HA is simpler to configure.

vs Fortinet HA (FGCP)FortiGate HA uses FGCP protocol for cluster management. Both support Active/Passive and Active/Active. FortiGate HA election uses different parameters (priority, serial number); Palo Alto uses primary/secondary designation.

Prerequisites

→Both firewalls must be identical hardware models running the same PAN-OS version
→HA1 link: dedicated point-to-point network (use management port or dedicated HA port)
→HA2 link: dedicated high-bandwidth link for session synchronization (use data plane interface)
→The secondary firewall should have initial base config (management IP) before enabling HA
→All data plane interfaces must be connected on both firewalls before enabling HA

Config Generator

Hostname *

HA Mode

HA Group ID

This device priority

Enable preemption?

HA1 Interface

HA1 Local IP *

HA1 Netmask

HA1 Peer IP *

Encrypt HA1?

HA2 Interface

HA2 Local IP

HA2 Netmask

HA2 Peer IP

HA2 Keepalive?

Passive hold timer (ms)

Session synchronization?

Verification commands

show high-availability state

Show HA pair status, role, and sync state

ExpectedPrimary: 'active', Secondary: 'passive'. Config sync: 'synchronized'. Running sync: 'synchronized'.

show high-availability all

Show comprehensive HA status including link states

ExpectedHA1 and HA2 links should be up. Shows peer IP, group ID, and failover trigger conditions.

show high-availability control-link statistics

Show HA1 link packet statistics

ExpectedNon-zero heartbeat packets sent/received. Zero received means HA1 connectivity is broken.

Debug commands

request high-availability sync-to-remote running-config

Force configuration sync from active to passive peer

Common mistakes & fixes

SymptomHA pair shows 'non-functional' or both in 'active' state (split-brain)

CauseHA1 control link is down — both firewalls think the other has failed

FixVerify HA1 physical connectivity. Check 'show high-availability control-link statistics'. Restore HA1 link — the secondary will automatically transition to passive.

SymptomConfig sync shows 'out of sync'

CauseConfig change made on active but sync failed, or a conflicting change was made on passive

FixForce sync: 'request high-availability sync-to-remote running-config'. Verify sync completed: 'show high-availability state'.

SymptomSessions not surviving failover (clients see connection resets)

CauseHA2 session synchronization not working or HA2 link is down

FixCheck HA2 link status: 'show high-availability data-link statistics'. Verify session sync is enabled on the tunnel.

Further learning

Recommended books to go deeper on this topic.

Palo Alto Networks Firewall Deployment and Administration

Tom Piens · Packt · PAN-OS HA — active/passive, active/active, session sync, preemption

Kindle ↗Hardcover ↗Paperback ↗

Cisco ASA: All-in-One Next-Gen Firewall, IPS, and VPN Services

Jazib Frahim, Omar Santos, Andrew Ossipov · Cisco Press · HA fundamentals — stateful failover concepts apply across vendors

Kindle ↗Hardcover ↗