Hello Message Interval -PANORAMA HA

[atul.srivastava]

Hi,

What is the correct default Hello Message interval in Panorama HA?

Is it 5000ms or 8000ms?

I am asking this because, PA docs have quoted these two values at default at two different places.

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/high-availability/ha-timers  quoting 8000ms

see the screenshot taken from EDU-120, Module - High Availability -- quoting 5000ms

Thanks

Atul

[gwesson]

8000 ms is the correct default value, which is also the lowest it can be configured to use.

You can confirm on your own device with the following op command:

> show system state filter-pretty cfg.ha.limits.timers

The results may look different depending on the version of PAN-OS you're running, but you should see a "hello-interval" with the values either way.

Looks like the training needs an update to reflect the correct default.

[show_run]

The 220 course notes for Panorama 8.1 and 9.0 notes say:

Hello messages are sent from one peer to another at the configured Hello interval, which has a default value of 1,000ms. The heartbeat is an ICMP ping to the HA peer, and the peer responds to the ping to establish that the peers are connected and responsive; the default interval is 8,000ms.

The Panorama 9.0 admin guide says:

The HA peers use hello messages and heartbeats to verify that the peer is responsive and operational.

Hello messages are sent from one peer to the other at the configured Hello Interval to verify the state of the other.

The heartbeat is an ICMP ping to the HA peer, and the peer responds to the ping to establish that the peers are connected and responsive.

By default, the interval is 1,000 milliseconds for the heartbeat and 8,000ms for hello messages.

It sounds like the author may have got mixed up, I suggest replacing the course notes paragraph with the correct one in the admin guide.

---

@atul.srivastava wrote:

Hi,

What is the correct default Hello Message interval in Panorama HA?

Is it 5000ms or 8000ms?

I am asking this because, PA docs have quoted these two values at default at two different places.

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/high-availability/ha-timers  quoting 8000ms

see the screenshot taken from EDU-120, Module - High Availability -- quoting 5000ms

Thanks

Atul

---