topic Re: PA 5050 HA Failover Premeption in General Topics

PA 5050 HA Failover Premeption

itsecll — Tue, 12 Jun 2012 19:54:13 GMT

I have configure Active/Passive HA between two PA 5050 Firewalls. One is at high(passive) Priority and another is low(Active). I have also configure Preemtion on Active Firewall, meaning if somehow Active PA fail ,the Passive become active ,but when the active comes up again it should come up as active again i.e , it should take the ownership again by becoming active. But this is not happening , the Passive which is becoming active when the failover occure remains active even though Active firewall is coming up again.

Please suggest what configuration need to be done for my requrement to work. How premeption is working in Palo Alto?

Thanks

Re: PA 5050 HA Failover Premeption

mikand — Wed, 13 Jun 2012 06:16:06 GMT

Verify that HA1 and HA2 is fully operational, also verify the following:

Preemptive—Enable the higher priority firewall to resume active operation after recovering from a failure. If this setting is off, then the lower priority firewall remains active even after the higher priority firewall recovers from a failure.

The firewall that is assigned the lower device priority value is the higher priority device and becomes the active firewall in an HA pair when preemption is enabled on both firewalls in the pair.

The Preemption option must be enabled on both devices for the higher priority firewall to resume active operation upon recovery following a failure.

Re: PA 5050 HA Failover Premeption

itsecll — Wed, 13 Jun 2012 07:40:00 GMT

Thanks to you Mikand. Its working.