Palo Alto Networks Certified Network Security Engineer (PCNSE)Deploy and ConfigureMedium
A company is upgrading its data center and is consolidating several physical firewalls into a single Palo Alto Networks firewall pair in an Active/Passive HA configuration. The network team needs to ensure that if the active firewall fails, the passive firewall takes over seamlessly with minimal disruption to existing TCP sessions. Which HA sync option is critical for achieving this requirement?
- ASession Synchronization
- BARP Load-Sharing
- CConfiguration Synchronization
- DHeartbeat Backup
Show answer & explanationAnswer & explanation
Correct answer: A. Session Synchronization
Session Synchronization (session-sync) is critical for maintaining existing TCP sessions during a failover in an Active/Passive HA pair. It ensures that the passive firewall has a synchronized copy of the active firewall's session table, allowing it to seamlessly take over and continue active connections without interruption.
Why the other options are wrong
- B. ARP Load-Sharing is primarily for Active/Active HA to distribute traffic and is not directly related to preserving sessions during an Active/Passive failover.
- C. Configuration Synchronization ensures both firewalls have the same policy and object configurations, but not active session states.
- D. Heartbeat Backup is part of the HA monitoring mechanism to detect failures, not to synchronize session states.
HA Session Synchronization
Session Synchronization in Palo Alto Networks HA ensures that active session states are replicated from the primary to the secondary firewall, allowing for seamless failover of existing connections.
- Crucial for maintaining TCP sessions during failover.
- Uses dedicated HA data link for replication.
- Requires specific configuration and monitoring.
Memory trick: HA Sync: Config for Rules, Session for Connections.