Palo Alto Networks Certified Network Security Engineer (PCNSE)Core ConceptsMedium
A network engineer is configuring a Palo Alto Networks firewall in a data center to provide high availability. The design specifies an Active/Passive HA pair, and the engineer needs to ensure that the passive firewall can take over seamlessly if the active firewall fails. Which of the following is crucial for maintaining network connectivity and stateful traffic flow during a failover event in an Active/Passive HA setup?
- AUsing different security policies on each firewall.
- BAssigning unique virtual routers to each firewall.
- CEnabling session synchronization between the HA peers.
- DConfiguring separate management interfaces for each firewall.
Show answer & explanationAnswer & explanation
Correct answer: C. Enabling session synchronization between the HA peers.
Enabling session synchronization is crucial for Active/Passive HA. It ensures that the passive firewall receives and maintains the state of active connections from the primary firewall, allowing for seamless failover without dropping existing sessions.
Why the other options are wrong
- A. Using different security policies would lead to inconsistent enforcement and break traffic flow after failover.
- B. Virtual routers are typically shared or synchronized in HA to maintain consistent routing; unique ones would hinder failover.
- D. Separate management interfaces are a best practice for management access but don't directly facilitate stateful failover.
Palo Alto Networks HA Session Synchronization
Session synchronization in Palo Alto Networks High Availability (HA) ensures that connection state information is replicated between active and passive firewalls, enabling seamless traffic flow during a failover event.
- Replicates session table entries, NAT sessions, and IPSec Security Associations.
- Prevents interruption of existing connections upon failover.
- Requires dedicated HA control and data links.
Memory trick: Synchronized sessions make failover 'Seamless' like a smooth transition.