Palo Alto Networks Certified Network Security Engineer (PCNSE)Deploy and ConfigureMedium
A security architect is designing a high-performance network where multiple firewalls need to share the load of processing traffic for a large number of users. The design requires that both firewalls actively process traffic simultaneously to maximize throughput. Which HA mode would best meet this requirement?
- AActive/Active with Layer 3 deployment
- BActive/Active with Layer 2 deployment
- CActive/Passive with session synchronization
- DActive/Passive with Virtual Wire deployment
Show answer & explanationAnswer & explanation
Correct answer: A. Active/Active with Layer 3 deployment
Active/Active HA allows both firewalls to process traffic simultaneously, sharing the load. Layer 3 deployment is the most common and flexible method to achieve this, using virtual routers and routing protocols to distribute traffic.
Why the other options are wrong
- B. While Active/Active HA can be deployed in Layer 2, Layer 3 deployment offers greater flexibility and is typically preferred for load sharing across multiple firewalls in complex networks.
- C. Active/Passive does not share the load; only one firewall processes traffic.
- D. Active/Passive does not share the load, and Virtual Wire is a deployment mode, not an HA mode that inherently enables load sharing.
Active/Active HA (Palo Alto)
A High Availability configuration where both firewalls actively process traffic concurrently, typically for load sharing and increased throughput.
- Both firewalls are active and forward traffic.
- Requires traffic distribution mechanisms (e.g., ECMP, link aggregation).
- Can be deployed in Layer 2 or Layer 3 modes.
- Provides increased throughput and redundancy.
Memory trick: Two active, for throughput's surge, a load-sharing urge!