require password change on first login on HA mode

[Tyson-Liu]

Hi Guys

I have question for "require password change on first login" on HA mode.

firstly when I enable this function at any Palo Alto unit of HA mode and edit or create admin role account,

then try login to one of HA unit, the login page display password change require. when I finish password change and try login another unit, the new password cannot login success, only original unit can success login using new password. 

also I think maybe HA sync problem, then I create new object and manual sync running-config at original unit,

new password still not sync to peer unit, the login page of another unit only allow old password to login and additionally show password change require again.

have someone can help me or suggest best practices for require password change on first login?

PAN-OS - 9.1.11

HA mode - Actice/Passive

thanks

regards,

Tyson