A company is implementing High Availability (HA) for their critical Palo Alto Networks firewalls in an Active/Passive configuration. The network team observes that during a failover event, there is a brief interruption in network traffic, even though the passive firewall successfully takes over. They want to minimize this traffic interruption as much as possible. Which HA synchronization setting, when properly configured, is designed to reduce traffic loss during a failover by ensuring session and configuration consistency?
- AConfig Sync
- BPreemptive Failover
- CHeartbeat Backup
- DSession Synchronization
Show answer & explanationAnswer & explanation
Correct answer: D. Session Synchronization
Session Synchronization is designed to minimize traffic interruption during a failover. When enabled, the active firewall continuously shares its session state information with the passive firewall over the HA control link. This allows the passive firewall, upon becoming active, to immediately take over existing sessions without having to re-establish them, significantly reducing traffic loss.
Why the other options are wrong
- A. Config Sync ensures that the configuration (policies, objects, interfaces) is consistent between HA peers, but it does not synchronize active session states.
- B. Preemptive Failover determines if a failed node can automatically return to active status once recovered, not about session continuity during failover.
- C. Heartbeat Backup provides redundancy for the HA heartbeat link but does not directly synchronize session state.
HA Session Synchronization
HA Session Synchronization in Palo Alto Networks Active/Passive clusters ensures that active session states are continuously replicated from the active firewall to the passive firewall, enabling seamless failover with minimal traffic interruption.
- Replicates session table, NAT table, ARP table, IPsec SA, and GlobalProtect tunnels.
- Requires a dedicated HA control link (HA1) and data link (HA2).
- Crucial for maintaining ongoing connections across a failover event.
- Reduces the impact of failover on end-user experience.
Memory trick: Synchronize sessions for seamless transitions, avoid those traffic omissions.