Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementMedium
A network security team is implementing a new Palo Alto Networks firewall and requires a highly available solution to minimize downtime. They choose to deploy two firewalls in an Active/Passive HA configuration. Which of the following statements accurately describes a key characteristic or requirement of this setup?
- AA dedicated HA link is used for heartbeats and state synchronization.
- BSession synchronization is not supported in Active/Passive mode.
- CBoth firewalls actively process traffic, sharing the load equally.
- DEach firewall must have a unique virtual router ID for proper failover.
Show answer & explanationAnswer & explanation
Correct answer: A. A dedicated HA link is used for heartbeats and state synchronization.
In an Active/Passive HA configuration, a dedicated HA link (often an Ethernet cable between two interfaces) is crucial for exchanging heartbeats to monitor peer status and synchronizing session and configuration state between the active and passive devices.
Why the other options are wrong
- B. Session synchronization is a key feature of Active/Passive HA, ensuring that existing connections are maintained during a failover event.
- C. This describes Active/Active mode, not Active/Passive, where only one firewall processes traffic at a time.
- D. Virtual router IDs are typically unique per virtual router instance, but the HA pair itself uses shared virtual MAC addresses for failover, not unique virtual router IDs for each firewall to distinguish failover.
Active/Passive HA
A high availability deployment where one firewall actively processes traffic while the other remains in a passive, synchronized standby state, ready to take over upon failure.
- One firewall is active, one is passive.
- Requires dedicated HA links for control and data plane synchronization.
- Ensures session continuity during failover.
Memory trick: Two firewalls stand ready, one leads, one shadows, linked by unseen threads.