Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementHard
A system administrator is reviewing the high availability (HA) configuration of a Palo Alto Networks firewall pair. They notice that the HA state is consistently showing as 'non-functional' even though the HA links are physically connected and showing as up. Upon further investigation, they find that the HA control link is configured with an IP address, but no corresponding IP address is configured on the peer firewall's HA control link interface. What is the MOST likely cause of the 'non-functional' HA state?
- AThe HA data link is not configured, preventing session synchronization.
- BPath monitoring is enabled but has no configured destinations to monitor.
- CThe HA control link interfaces on both firewalls do not have matching IP addresses within the same subnet.
- DThe HA peer ID is incorrectly configured, leading to a mismatch.
Show answer & explanationAnswer & explanation
Correct answer: C. The HA control link interfaces on both firewalls do not have matching IP addresses within the same subnet.
For the HA control link to establish communication, both firewalls must have IP addresses configured on their respective HA control link interfaces that are within the same subnet. Without this, the devices cannot communicate over the control link, leading to a non-functional HA state, even if the physical link is up.
Why the other options are wrong
- A. Lack of an HA data link would primarily affect session synchronization, not necessarily render the entire HA state 'non-functional' regarding basic control link establishment.
- B. Path monitoring issues would affect failover decisions, but the basic HA control link should still establish if its IPs are correctly configured.
- D. An incorrect HA peer ID would prevent the firewalls from recognizing each other as peers, but the immediate issue described (no communication despite physical link) points more directly to IP configuration on the link itself.
HA Control Link IP
The Palo Alto Networks HA control link requires a Layer 3 IP address configuration on both peer firewalls, with both IPs residing in the same subnet, to facilitate heartbeat, state exchange, and configuration synchronization.
- Crucial for HA communication.
- Requires IP address on each peer.
- IPs must be in the same subnet.
- Supports heartbeat, state, and config sync.
Memory trick: IP Inconsistency Impedes HA Interconnection.