topic Re: PaloAlto firewall HA upgrade in General Topics

PaloAlto firewall HA upgrade

thushy — Thu, 27 Feb 2025 09:30:47 GMT

I am new to Palo Alto firewalls. I need to upgrade the firmware on PA-3220 firewalls in A-P HA . Firewalls doesn't have management ports connected to network and they are remote. It looks like i need management port access of individual firewall to upgrade the firmware. Is it possible to upgrade without management port access? if so, how do you do that? if it is required, can i use any other ports for management connectivity of the firewall for firmware upgrade?

Thanks

Re: PaloAlto firewall HA upgrade

Mudhireddy — Thu, 27 Feb 2025 10:52:47 GMT

Recommended HA Interface Assignments

HA Function	Recommended Interface	Purpose
HA1 (Control Link)	Management Port or Ethernet1/1 – Ethernet1/9	Synchronizes configuration, heartbeats, and failover messages
HA1 Backup (Optional)	Ethernet1/10 – Ethernet1/12	Backup for HA1 in case of failure
HA2 (Data Link)	Ethernet1/10 – Ethernet1/12	Synchronizes session tables, forwarding tables, and objects
HA2 Backup (Optional)	Ethernet1/9 – Ethernet1/12	Backup for HA2 if the primary link fails
HA3 (Packet Forwarding Sync, for Active-Active HA only)	Ethernet1/10 – Ethernet1/12	Syncs packets in Active-Active mode

Re: PaloAlto firewall HA upgrade

thushy — Thu, 27 Feb 2025 11:06:38 GMT

What would be the dedicated HA management interface when we do the upgrade. That interface IP shouldn't sync across the devices. can we use any ports other than mgmt port?

Thanks

Re: PaloAlto firewall HA upgrade

Raido_Rattameister — Thu, 27 Feb 2025 13:26:44 GMT

You need mgmt port to access specific device.

Only active firewall can be accessed through dataplane ports.

Procedure:

Upgrade passive

Reboot passive

Wait until passive returns from reboot and is functional

Upgrade active

Reboot active

If you have preemtion enabled then active role will migrate back to the firewall it was initially.