topic Re: Does PA fail closed by default? in General Topics

Does PA fail closed by default?

jbankstonfla — Mon, 05 Dec 2022 18:25:33 GMT

I'll be darned if I can find any documentation that speaks to if/how interfaces are configured to fail closed if there's a system or interface issue.

Does anyone have a URL that talks to this?

Thanks, Jeff

Re: Does PA fail closed by default?

PavelK — Tue, 06 Dec 2022 04:40:09 GMT

Hello @jbankstonfla

could you please provide more details about scenario of failure? Without knowing details of your question, my general reply would be as below:

- If you mean a support for "bump in the wire" where interfaces will support hardware relay to allow flowing of traffic in the case of hardware failure, then this is not supported with Palo Alto, so default is fail close.

- Best practice is to build an HA pair to fail over in the case interface or system goes down. If an interface goes down and interface tracking is enabled under HA, the other Firewall in the HA pair will take it over. If entire system goes down, then based oh heartbeat failover will take place.

Kind Regards

Pavel

Re: Does PA fail closed by default?

OtakarKlier — Tue, 06 Dec 2022 23:18:32 GMT

Hello,

From the last few cases I posted to TAC regarding this, there is no documentation. So to satisfy the auditors, I create a TAC case with the question. Then use the TAC case number and their response as the artifact/documentation.

The gov auditors accept this answer.

Regards,