A security engineer is performing routine maintenance on a Palo Alto Networks firewall in an active/passive High Availability (HA) configuration. After performing a 'suspend local' command on the active firewall, the passive firewall fails to transition to the active state. Investigation reveals that the passive firewall's HA state is 'non-functional'. What is the MOST likely reason for the passive firewall being in a 'non-functional' state?
- AThe HA Keep-Alive link is down or congested.
- BThe passive firewall has failed its path monitoring checks.
- CThe HA Control link is down or experiencing issues.
- DThe passive firewall's configuration is out of sync with the active firewall.
Show answer & explanationAnswer & explanation
Correct answer: B. The passive firewall has failed its path monitoring checks.
A 'non-functional' HA state on a Palo Alto Networks firewall typically indicates that the firewall has failed its configured path monitoring or link monitoring checks. These checks are designed to ensure the firewall has connectivity to critical network devices or interfaces, and if they fail, the firewall will transition to a 'non-functional' state to prevent it from becoming active and blackholing traffic.
Why the other options are wrong
- A. Keep-Alive link issues usually lead to a 'split-brain' scenario or a failure to detect peer state, but not directly a 'non-functional' state on the passive firewall itself.
- C. Control link issues would prevent configuration synchronization and heartbeats, leading to a 'split-brain' or 'non-sync' state, not typically 'non-functional' due to self-monitoring failures.
- D. Configuration out of sync would be reported as a 'non-sync' or 'partial-sync' state, not 'non-functional'.
HA Non-Functional State
In Palo Alto Networks HA, a 'non-functional' state signifies that a firewall has failed its critical path monitoring or link monitoring checks, indicating it cannot reliably forward traffic.
- Path/Link monitoring checks external connectivity.
- Failure prevents a firewall from becoming active.
- Designed to prevent blackholing of traffic.
Memory trick: The standby guard is broken; its eyes on the network are shut!