Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementMedium
A network architect is designing a high-availability solution for a critical data center using Palo Alto Networks firewalls. They have chosen an Active/Active HA configuration. Which of the following is a primary benefit of choosing Active/Active over Active/Passive HA?
- ASimplified configuration and management.
- BHigher throughput and resource utilization.
- CAutomatic software updates without downtime.
- DReduced licensing costs due to shared resources.
Show answer & explanationAnswer & explanation
Correct answer: B. Higher throughput and resource utilization.
Active/Active HA allows both firewalls to actively process traffic, effectively doubling the potential throughput and utilizing the resources of both devices simultaneously, unlike Active/Passive where one device is idle.
Why the other options are wrong
- A. Active/Active HA is significantly more complex to configure and manage than Active/Passive.
- C. While HA generally helps with maintenance, automatic software updates without downtime are not a unique primary benefit of Active/Active over Active/Passive; both modes require careful planning for upgrades.
- D. Active/Active HA still requires two fully licensed firewalls, so it does not reduce licensing costs.
Active/Active HA Benefit
Active/Active High Availability on Palo Alto Networks firewalls enables both devices to process traffic simultaneously, improving performance and resource utilization.
- Both firewalls are active traffic processors.
- Increases total throughput capacity.
- More complex to configure than Active/Passive.
Memory trick: Active/Active: double the fire, double the power, for peak traffic hour!