topic Re: HA Configuration Sync from PA-A to PA-B? in General Topics

HA Configuration Sync from PA-A to PA-B?

Y.Acosta170952 — Wed, 13 May 2026 20:14:05 GMT

Hello everyone,

Here is the scenario:

PA-A has the full configuration and a Device Priority of 50.
PA-B has no configuration and a Device Priority of 100.
Both firewalls are configured in Active-Passive mode and belong to the same Group ID.

Under High Availability → General → Setup, for the option “Enable Config Sync”, which firewall should have this setting enabled — PA-A or PA-B?

for both to have all the configure?

Re: HA Configuration Sync from PA-A to PA-B?

PavelK — Wed, 13 May 2026 22:13:53 GMT

Hello @Y.Acosta170952

best practice is to enabled the "Enable Config Sync" in both Firewalls in HA pair. Below are references from KBs:

How to Configure High Availability on PAN-OS

High-Availability - Out of Sync Peers - Configuration

Kind Regards

Pavel

Re: HA Configuration Sync from PA-A to PA-B?

JayGolf — Wed, 13 May 2026 22:23:48 GMT

Hi @Y.Acosta170952 ,

You would enable Config Sync on both firewalls in the HA pair. Once HA is established and config sync is enabled, PA-A with the lower device priority of 50 becomes the source of truth and will sync the running config to your PA-B with the priority of 100.

Regarding your PA-B with no config, I would make sure that PA-B has the same PAN-OS version, content versions, and have the mgmt/data interfaces aligned before syncing.

Re: HA Configuration Sync from PA-A to PA-B?

MP18 — Fri, 15 May 2026 18:18:19 GMT

@Y.Acosta170952170952 Both firewalls need to have the config sync available .

Regards