How to disable config sync in a HA pair?

[asia]

Hello,

I'am using to PAN devices in a HA pair, and i want to make some changes on one and not on the other before doing a switchover. Can i disable only config synchronisation and let all the other HA functionality up?

Regrds.

[nrice]

You can suspend the passive device and make your changes.  The configs will synch once you make suspended device functional again.  >request high-availability state suspend  > request high-availability state functional.  You can also disable HA by unchecking "Enable HA"  on the Device tab >High Availability.

[asia]

Thank you Rice,

But my need, is to maintain the HA pair functional (the heart beat), and to disable only the config synchronisation, is it possible?

Regards.

[nrice · Accepted solution]

There isn't a command to disable synchronization of the configs as that would defeat the purpose of the HA pair.

[mb_equate]

Of course you can disable synchronisation of the configs in an HA pair, in fact it's required to migrate one to Panorama: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall... 

From the CLI:

user@device(active)# set deviceconfig high-availability group configuration-synchronization enabled no

🙂

[reaper]

@mb_equatethis post was started in 2010, back then Acitve-Active didn't even exist yet. In the meanwhile , as you pointed out correctly, this option was added in the HA settings

[mb_equate]

I just realised that, d'oh!

This thread is archived

New comments cannot be posted and votes cannot be cast