Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateMedium
A network administrator is configuring a Palo Alto Networks firewall for High Availability (HA) in an active/passive configuration. The firewall has two data interfaces (ethernet1/1, ethernet1/2) and two HA interfaces (HA1, HA2). Which of the following statements accurately describes the recommended configuration for the HA2 link?
- AThe HA2 link should be configured as a Layer 3 interface with a dedicated IP address for session synchronization.
- BThe HA2 link should be configured as a dedicated data plane interface for load balancing.
- CThe HA2 link is optional and primarily used for management plane redundancy.
- DThe HA2 link should be configured as a Layer 2 interface for control plane communication and heartbeat messages.
Show answer & explanationAnswer & explanation
Correct answer: A. The HA2 link should be configured as a Layer 3 interface with a dedicated IP address for session synchronization.
The HA2 link in an active/passive HA configuration is dedicated to data-plane synchronization, specifically for forwarding session and configuration synchronization traffic between the active and passive firewalls. It must be a Layer 3 interface with dedicated IP addresses to allow for efficient and reliable data synchronization.
Why the other options are wrong
- B. HA2 is for synchronization, not load balancing. In active/passive HA, only one firewall handles data plane traffic at a time.
- C. The HA2 link is not optional for robust HA deployments, especially for session synchronization, and is not primarily for management plane redundancy.
- D. The HA1 link is typically used for control plane communication (heartbeat, HA state exchange). HA2 is for data plane synchronization.
Palo Alto Networks HA2 Link
The HA2 link is a dedicated physical connection between two Palo Alto Networks firewalls in an HA pair, used for data-plane synchronization, including session, ARP, and NAT table synchronization.
- Dedicated for data-plane synchronization.
- Must be configured as a Layer 3 interface.
- Requires dedicated IP addresses on both HA peers.
Memory trick: HA1 for Heartbeats, HA2 for Session Sync.