High Availability and Redundancy Flashcards

Which HA configuration setting determines which firewall becomes Active when both peers are healthy and preemption is enabled?

Answer: HA Device Priority

HA Device Priority (lower numerical value = higher priority) determines which firewall takes the Active role when both devices are healthy.

What is the recommended best practice for the HA1 Control Link to ensure high reliability?

Answer: Configure an HA1 backup link on a separate physical interface

Configuring a backup HA1 link on a separate physical interface ensures control link redundancy in case the primary HA1 path fails.

In Palo Alto HA, what is the 'split brain' condition?

Answer: Both firewalls believing they are Active at the same time

Split brain occurs when both HA peers simultaneously assume the Active role, typically due to a loss of the HA1 control link, causing traffic disruption.

Which HA feature allows a Palo Alto firewall to monitor an upstream router and trigger failover if the path fails?

Answer: Path Monitoring

Path Monitoring sends ICMP probes to specified IP addresses and triggers HA failover if the monitored path becomes unreachable.

What is the function of the HA3 link in an Active/Active HA deployment?

Answer: To forward packets between peers when a session is owned by one firewall but traffic arrives at the other

The HA3 link in Active/Active mode forwards packets between peers when asymmetric routing sends return traffic to the firewall that did not originate the session.

When performing a software upgrade on an HA pair, what is the recommended procedure to avoid downtime?

Answer: Upgrade the Passive firewall first, then manually fail over, then upgrade the original Active

The recommended procedure is to upgrade the Passive firewall first, perform a manual failover so it becomes Active, then upgrade the original Active firewall.