High Availability and Redundancy Flashcards

In Palo Alto Networks High Availability, what is the role of the Active firewall?

Answer: It actively processes all network traffic and enforces security policy

In an Active/Passive HA pair, the Active firewall processes all live network traffic while the Passive firewall stands by in a synchronized state.

Which HA link is used to synchronize session tables and runtime data between HA peers?

Answer: HA2 (Data Link)

The HA2 Data Link synchronizes session state, forwarding tables, and IPsec security associations between the Active and Passive firewalls.

What is the purpose of the HA1 Control Link in a Palo Alto HA pair?

Answer: To exchange heartbeats and synchronize configuration between peers

The HA1 Control Link carries heartbeat packets, hello messages, and configuration synchronization between HA peers.

In Active/Active HA mode, how is traffic distributed between the two firewalls?

Answer: Both firewalls simultaneously process traffic, typically with a load balancer

In Active/Active HA, both firewalls process traffic concurrently, usually with an upstream load balancer or ECMP distributing sessions between them.

What condition triggers a failover in an Active/Passive HA pair?

Answer: The Active firewall fails a link monitoring or heartbeat check

Failover is triggered when the Active firewall fails link monitoring checks or heartbeats stop, causing the Passive firewall to transition to Active.

What does 'preemption' mean in the context of Palo Alto HA?

Answer: The higher-priority firewall automatically reclaiming the Active role after recovery

Preemption allows the firewall with a higher HA priority to automatically take back the Active role once it recovers from a failure.