High Availability and Redundancy Flashcards

Which HA state indicates that a firewall is actively passing traffic and enforcing policy?

Answer: Active

The 'Active' HA state means the firewall is fully operational, processing user traffic, and enforcing security policies.

What does the 'HA Suspended' state mean on a Palo Alto firewall?

Answer: The firewall has been administratively removed from the HA pair and will not take over

A Suspended HA firewall has been manually taken out of the HA pair by an administrator and will not participate in failover.

In a Palo Alto HA pair, which sessions are synchronized to the Passive firewall by default?

Answer: All established sessions including TCP, UDP, and ICMP

By default, the HA2 link synchronizes all established sessions so the Passive firewall can continue them transparently after a failover.

What minimum HA timer setting results in the fastest failover detection but highest CPU overhead?

Answer: Aggressive

Aggressive HA timer settings use shorter heartbeat intervals and faster failure detection, providing quicker failover at the cost of increased CPU utilization.

Which Palo Alto feature allows a virtual IP address to move between HA peers during failover, ensuring uninterrupted connectivity?

Answer: Floating IP

A Floating IP is a virtual IP address configured on an HA pair that moves to the currently Active firewall, maintaining connectivity for downstream devices.

In Palo Alto HA, which log type records failover events and HA state transitions?

Answer: System Logs

System Logs record HA state changes, failover events, peer connectivity issues, and configuration sync status.