Palo Alto Networks Certified Network Security Administrator (PCNSA)Palo Alto Networks Security PlatformMedium
A network architect is designing a highly resilient network using Palo Alto Networks firewalls. The design specifies that if the primary firewall fails, a secondary firewall must automatically take over all traffic processing with minimal interruption. Which feature enables this capability?
- APolicy-Based Forwarding
- BHigh Availability
- CVirtual Wire
- DGlobalProtect
Show answer & explanationAnswer & explanation
Correct answer: B. High Availability
High Availability (HA) ensures business continuity by providing redundancy. In an HA configuration, two firewalls work together, and if the active firewall fails, the passive firewall automatically takes over, maintaining connectivity and security enforcement.
Why the other options are wrong
- A. Policy-Based Forwarding (PBF) directs traffic based on policies, not for HA.
- C. Virtual Wire is a deployment mode, not a redundancy feature.
- D. GlobalProtect is for remote user VPN access, not firewall redundancy.
High Availability (HA)
A configuration where two Palo Alto Networks firewalls are deployed in a pair to provide redundancy and automatic failover, ensuring continuous network security and operation in case of a primary device failure.
- Active/passive or active/active modes
- Heartbeat and data links for synchronization
- Automatic failover for business continuity
Memory trick: HA keeps the network alive, even if one firewall dives.