Does PA fail closed by default?

[jbankstonfla]

I'll be darned if I can find any documentation that speaks to if/how interfaces are configured to fail closed if there's a system or interface issue.

Does anyone have a URL that talks to this?

Thanks, Jeff

[PavelK]

Hello @jbankstonfla

could you please provide more details about scenario of failure? Without knowing details of your question, my general reply would be as below:

- If you mean a support for "bump in the wire" where interfaces will support hardware relay to allow flowing of traffic in the case of hardware failure, then this is not supported with Palo Alto, so default is fail close.

- Best practice is to build an HA pair to fail over in the case interface or system goes down. If an interface goes down and interface tracking is enabled under HA, the other Firewall in the HA pair will take it over. If entire system goes down, then based oh heartbeat failover will take place. 

Kind Regards

Pavel

[OtakarKlier]

Hello,

From the last few cases I posted to TAC regarding this, there is no documentation. So to satisfy the auditors, I create a TAC case with the question. Then use the TAC case number and their response as the artifact/documentation.

The gov auditors accept this answer.

Regards,