HA Configuration Sync from PA-A to PA-B?

[Y.Acosta170952]

Hello everyone,

Here is the scenario:

• PA-A has the full configuration and a Device Priority of 50.
• PA-B has no configuration and a Device Priority of 100.
• Both firewalls are configured in Active-Passive mode and belong to the same Group ID.

Under High Availability → General → Setup, for the option “Enable Config Sync”, which firewall should have this setting enabled — PA-A or PA-B?

for both to have all the configure? 

[PavelK]

Hello @Y.Acosta170952

best practice is to enabled the "Enable Config Sync" in both Firewalls in HA pair. Below are references from KBs:

How to Configure High Availability on PAN-OS

High-Availability - Out of Sync Peers - Configuration

Kind Regards

Pavel  

[JayGolf · Accepted solution]

Hi @Y.Acosta170952 ,

You would enable Config Sync on both firewalls in the HA pair. Once HA is established and config sync is enabled, PA-A with the lower device priority of 50 becomes the source of truth and will sync the running config to your PA-B with the priority of 100. 

Regarding your PA-B with no config, I would make sure that PA-B has the same PAN-OS version, content versions, and have the mgmt/data interfaces aligned before syncing.  

[MP18]

@Y.Acosta170952170952 Both firewalls need to have the config sync available .

Regards