Interface change sync

MSANWB — Fri, 09 Dec 2022 12:14:12 GMT

Hi we have two PA-3220 in an HA active/passive configuration

When i make a change to an interface on the passive firewall, for example i change the interface type to Aggregate Ethernet after i commit i see that the same interface on the active firewall will also be changed to type Aggregate Ethernet with the same Aggregate Group specified. Is this the expected behavior or can i change this?

Re: Interface change sync

kiwi — Fri, 09 Dec 2022 12:48:10 GMT

Hi @MSANWB ,

That's expected behavior.

Commits are possible on either active or passive device. If you have enabled configuration synchronization on both peers in an HA pair, most of the configuration settings you configure on one peer will automatically sync to the other peer upon commit.

Only a limited set of configuration options aren't synced:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha#id88817587-918d-4c99-8576-271b8df7ba6c

To avoid configuration conflicts, it's recommended to always perform the commits on the same unit.

Kind regards,

-Kiwi.

topic Interface change sync in General Topics

Interface change sync

Re: Interface change sync