topic Re: HA1-Backup Failing when setting to Management in Next-Generation Firewall Discussions

HA1-Backup Failing when setting to Management

jwill2 — Thu, 28 Aug 2025 19:00:28 GMT

I have a pair of 1410's configured for HA. Because the firewalls are not in the same room, I need to use the management interface for the HA1 backup.

When I do the commit in Panorama, it commits without error. However, when I go to push it out, I get:

Details:
. Validation Error:
. deviceconfig -> high-availability -> interface -> ha1-backup -> port 'management' is not an allowed keyword
. deviceconfig -> high-availability -> interface -> ha1-backup -> port 'management' is not a valid reference
. deviceconfig -> high-availability -> interface -> ha1-backup -> port is invalid
. Commit failed

Re: HA1-Backup Failing when setting to Management

jwill2 — Thu, 28 Aug 2025 19:06:58 GMT

So I was looking at the actual firewall context to see if I could set it manually, but only ha1-a and ha1-b are options. Management is not an option.

Is this something specific to the newer firewalls that have physical ha1-a and ha1-b ports?

Is there a way to utilize management for the ha1-backup?

Also, is it me or are Palo error messages unhelpful.

Re: HA1-Backup Failing when setting to Management

PavelK — Thu, 28 Aug 2025 22:21:07 GMT

Hello @jwill2

thanks for post!

In the official KB and documentation: HA1 interfaces on PA-3400 and PA-5400 series cannot be configured on the management port only PA-3400 and PA-5400 series are mentioned as affected platforms. I do not have PA-1400 Firewall at my disposition to confirm it, however it looks like that PA-1400 has this limitation as well.

Kind Regards

Pavel

Re: HA1-Backup Failing when setting to Management

PavelK — Thu, 28 Aug 2025 22:27:13 GMT

Hello @jwill2

I found the answer in data sheet: PA-1400 Series Next-Gen Firewall Hardware Reference:

Kind Regards

Pavel

Re: HA1-Backup Failing when setting to Management

jwill2 — Fri, 29 Aug 2025 14:30:47 GMT

Perfect. Thank you. Seems kind of stupid that they would get rid of using management as an option. There is a use case where the firewalls are physically distant with no direct copper. As is the case with this deployment.

I've got it working by running HA1a through the internal network but wanted a backup path in case that link/path/switch were to go down.

Re: HA1-Backup Failing when setting to Management

E.Rodriguez813669 — Fri, 29 Aug 2025 14:55:31 GMT

The port mgmt cannot be configured as HA1 backup in Panorama, only as HA1. That's why the push fails.