topic Re: suspend active panorama when passive panorama is rebooting in General Topics

suspend active panorama when passive panorama is rebooting

MP18 — Wed, 17 Oct 2018 22:37:59 GMT

If passive panorama is going through reboot.

Active Panorama shows passive panorama as unknown

what will happen if i suspend the active Panorama ?

will all the firewalls connected to the Active panorama will get disconnected?

Re: suspend active panorama when passive panorama is rebooting

LukeBullimore — Wed, 17 Oct 2018 23:38:54 GMT

Hey @MP18

It sounds like HA has not fully initialized yet, I would not suspend at all until you can fully verify that one unit is active and one is passive - for both Panorama and Firewall HA alike.

Typically after a reboot you will see HA finalize init state after the autocommit process completes.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVBCA0

Cheers,

Luke.

Re: suspend active panorama when passive panorama is rebooting

MP18 — Thu, 18 Oct 2018 13:46:01 GMT

i need to know what will happen if i suspend the active panorama while passive is rebooting?

will active will show all firewalls disconnected?

Re: suspend active panorama when passive panorama is rebooting

LukeBullimore — Thu, 18 Oct 2018 14:36:39 GMT

Correct. If the passive Panorama is down and you suspend the Active Panorama, then the firewalls will disconnect from Panorama.

As I believe you ascertained in a previous post - despite the fact they are disconnected, the firewalls will still have their configuration and continue to pass traffic.

Re: suspend active panorama when passive panorama is rebooting

MP18 — Thu, 18 Oct 2018 15:11:19 GMT

one more question on that

IF firewall is configured to send logs to external connector.

Firewall is disconnected from the panorama can it still pull up logs from external collector?

Re: suspend active panorama when passive panorama is rebooting

LukeBullimore — Thu, 18 Oct 2018 15:16:06 GMT

The firewall still has the capability to forward logs to other destinations if it is disconnected from Panorama, yes.

For example, you have a log forwarding profile with a syslog server profile attached and forward to Panorama option checked. Even if the firewall is disconnected from Panorama the logs will still be sent to the syslog server.

Re: suspend active panorama when passive panorama is rebooting

MP18 — Thu, 18 Oct 2018 15:54:32 GMT

Many thanks for answering the questions