Query on HA failover

FarzanaMustafa — Thu, 01 Aug 2019 06:07:40 GMT

Currently our secondary unit is running as Primary.

We have upgraded our Secondary (originally Primary) FW and now would like to do the failover so that it becomes Primary.

If the failover doesn't work as expected what should be done straightaway to avoid any traffic loss?

Re: Query on HA failover

TommieVanHove — Thu, 01 Aug 2019 08:40:11 GMT

so you curerntly have:

fw1 --> running the new os and passive?

fw2 --> running the old image and active.

ha status is okay but pan-os version is mismatch and config is not synced( which is normal during upgrade of a cluster)

the fastest way according to me( if you have followed upgrade best practices and turned preempt off)

is to suspend the active firewall(running old os) and with preempt disable there should be no issue making the device functional again right away.

at this point you will have failed over to the fw1 running the new image.
if you notice issues it's simply a case of suspending the fw1 with the new image so you fallback to the other cluster member.

the failovers during an upgrade should be just as fast as before teh upgrade. so if you did not lose any pings when failing over before you started you can expect the same now.

topic Re: Query on HA failover in General Topics

Query on HA failover

Re: Query on HA failover