topic Re: HA syn configuration in Next-Generation Firewall Discussions

HA syn configuration

ZhangShengXiang — Fri, 09 Dec 2022 08:07:20 GMT

I have 2 PA-440 configure by HA,now one of FW hardware down,And I get a new FW from RMA.now I connect this new FW.

When I press "Sync to peer device", it prompts me that synchronization failed. I understand because I have not imported the license to the new firewall. If I import the license into the new firewall, can I directly synchronize the active firewall configuration to passive firewall?

Re: HA syn configuration

PavelK — Fri, 09 Dec 2022 13:04:30 GMT

Hello @ZhangShengXiang

this is correct understanding. If both firewalls do not have an identical set of licenses, they cannot synchronize configuration information. Having the same license is one of the pre-requisite: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activepassive-ha/prerequisites-for-activepassive-ha

After, you have licensed your passive Firewall, also install corresponding PAN-OS, Threat/App version, then you should not have an issue to sync up.

Kind Regards

Pavel

Re: HA syn configuration

ZhangShengXiang — Fri, 09 Dec 2022 20:44:03 GMT

Got it.You mean it will be syn complete when I import the license in passive firewall.whatever the Passive firewall was empty configuration.

I worried about that because Passive firewall cannot connect to internet,so it cannot download globalprotect version and others,the HA dashboard show globalprotect mismatch will not impact on synchronization?

Just need these matches in the picture.This is my understand.It's right?

Re: HA syn configuration

PavelK — Fri, 09 Dec 2022 21:17:50 GMT

Hello @ZhangShengXiang

thank you for reply.

The order of operation to bring Passive Firewall in sync should be as follows.

- Make sure that Passive Firewall has DNS server / NTP server, Hostname / Domain name, Time Zone,..etc configured. These settings are not HA synchronized (Here is a full list of config that is not synced between Active/Passive Firewall: Settings Don’t Sync in Active/Passive HA ) and some of them are required to connect to update portal to download the content (PAN-OS images, App/Threat updates,...)

- After you complete the above step, either let Firewall fetch license online from portal or import license manually if necessary. After Passive Firewall is properly licensed, you will be able to download content under: Device > Software/Global Protect/Dynamic Updates. After you install versions matching Active Firewall, you should be able to sync configuration from Active Firewall to Passive by clicking on sync to peer from Active Firewall.

- If you get an error preventing HA sync, I would review error and take troubleshooting from there.

Kind Regards

Pavel

Re: HA syn configuration

ZhangShengXiang — Mon, 12 Dec 2022 05:01:27 GMT

Hi PavelK

I have syn the configuration to passive,but the globalprotect cannot download.should i make this FW to active,and can download version?

Re: HA syn configuration

Raido_Rattameister — Mon, 12 Dec 2022 16:08:01 GMT

Under "Device > Setup > Services > Service Route Configuration" do you use management interface or some dataplane interface to communicate with Palo Alto Networks?

If management interface then both firewalls can pull updates and GlobalProtect software if dataplane interface then only active firewall can update.