topic Re: Strange behaviour of HA pair active passive in General Topics

Strange behaviour of HA pair active passive

Padmin7 — Tue, 11 Aug 2020 10:21:46 GMT

Today i've noticed a strange behaviour of HA pair of Pa820 (panos 8.1.6) in Active passive configuration.

In the dashboard page i've noticed the running config not in sync with peer.

So i checked the differences with the diff button and i discovered that master node want to replace its own ha settings on the slave node.

And also the management ip!

Of course i've not pushed the sync but i'm worried about such state of the firewall.

Re: Strange behaviour of HA pair active passive

Remo — Tue, 11 Aug 2020 11:42:49 GMT

Hi @Padmin7

You don't have to worry about these entries when you click to manually sync the configuration. For some reason there is something that make the firewall show that it is no longer in sync even while it looks like there is everythinh good (as long as thats all on your screenshot). To have them in sync again you need to click this sync button. The management IP and HA settings aren't synced between active/passive firewalls. The full list of configurations and settings that aren't synced between the firewalls you can find here: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha

Re: Strange behaviour of HA pair active passive

Padmin7 — Tue, 11 Aug 2020 12:55:07 GMT

However sometimes ago i experienced for two times on two different pair of ha clusters that the master and slave were running the same HA config but fortunately the managemnt ip was not affected and i was able to restore the correct config.