Summary:

Mode choices:

  • Active/standby

  • Active/active: not recommended to use this unless you have asymmetric routing issue 

(Asymmetric routing issue: the traffic goes out from one path but return traffic comes back from a different path)

 

 

HA Links:

  • HA1 (Control link): hello message, heart beats, HA state info, user ID info, configuration sync  

  • HA2 (Data link): session info; forwarding tables; IPSec SAs; ARP 

  • 3rd interface for Active Active!!!!

 

 

Triggers

  • Heartbeats (icmp ping b/w 2 fws control link - HA1) + Hello Messages

  • Link monitoring: monitor a group of interfaces on the firewalls 

  • Path monitoring: you set a ping to a specific destination, if we don’t get echo reply back then it triggers failover  

 

Pre-reqs

  • Same model

  • Same PanOS/Version

  • Same Interface (you can borrow mgmt interface for control link)

  • Licenses

 

Configs on the secondary firewall:

  1. You need to configure the HA interface on the 2nd fw

  2. Mimic the HA settings from primary fw (i.e. enabling HA, choose HA2 interface, Device priority)