Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementMedium
A network security architect is designing a high-availability (HA) solution for a pair of Palo Alto Networks firewalls. They aim for seamless failover of traffic and session synchronization. Which of the following is a critical prerequisite for successful HA session synchronization between the two firewalls?
- AA dedicated HA session synchronization link must be established between the firewalls.
- BWildFire and URL Filtering licenses must be identical and active on both devices.
- CBoth firewalls must be running different PAN-OS versions for redundancy.
- DThe HA control link must be configured as a Layer 3 interface.
Show answer & explanationAnswer & explanation
Correct answer: A. A dedicated HA session synchronization link must be established between the firewalls.
For seamless failover and session synchronization, a dedicated HA session synchronization link is crucial. This link carries the session state information between the active and passive firewalls, allowing the passive firewall to take over active sessions without interruption during a failover.
Why the other options are wrong
- B. While identical licenses are important for consistent feature operation, they are not a direct technical prerequisite for the HA session synchronization mechanism itself.
- C. Incorrect. Both firewalls in an HA pair must run the exact same PAN-OS version for proper operation and synchronization.
- D. The HA control link can be Layer 2 or Layer 3, but the session synchronization link (often separate or part of the control link) is specifically for state information.
HA Session Sync Link
A dedicated link or channel between two Palo Alto Networks firewalls in an HA pair, used to synchronize session state information.
- Enables seamless failover of active connections.
- Transmits runtime information between HA peers.
- Separate from the HA control link, though often carried over the same physical connection.
Memory trick: To keep HA sessions 'in sync', the firewalls need a dedicated 'whisper line' for their state secrets.