PA-5220 AUX ports for HA1 + HA1 backup

Showing results for 
Search instead for 
Did you mean: 

PA-5220 AUX ports for HA1 + HA1 backup

L4 Transporter



Tried to setup a PA-5220 cluster and I can't get HA1 and HA2 to talk over AUX1 + AUX2


is it possible ?  The GUI allows me to pick the interface.




L4 Transporter



HA2 is a 40G interface,  I don't believe you can use the AUX2 (1gig interface to take over the built in HA2).


However, I did that in the lab to use AUX1 instead of the built in HA1.


-- Followed admin guide and found that aux-1 interface needs to be assigned ip under tab Device > Setup > Interfaces > aux-1.
-- Added IP-Address, Default Gatgeway and allowed ping service.
-- Selected aux-1 under Device > High Availability > HA1. Commit is successful this time.
-- Also, guided how to check interface setting on CLI for aux-1 by running below CLI command,

> show interface aux-1


hope this helps,





My miss type


HA1 and HA1 backup ... not HA1 and HA2


For note my HA2 is using eth6/7 for 10G

my ha3 is using the 2xQSFP



Hi Alex,


I have configured HA active/passive using aux port successfully. Initially, I got an error as


" High-availability ha1 IP information will use interface IP information if port is 'aux-1. Please remove IP information from ha1(Module: ha_agent)
Error: HA1 Port is not configured

Error: ha configuration error"


Then I have enabled the AUX port and assigned IP address, subnet mask and default gateway (if required). As per the previous discussion.


Then I tried by removing IP from Control Link (HA1) and Control Link (HA1 Backup).  Then I was able to commit successfully and verified the HA status, it seems to be properly synchronized. Since both Control Link (HA1) and Control Link (HA1 Backup) taken the IP information from the AUX port.


Thanks & Regards,

Amarnath Dhanapal 


This trips up a lot of people that run the 5200 series firewalls, however as you've noticed you've found the proper configuration. When using the AUX ports you simply configure the IP information on the ports themselves, the HA information can be left blank as it'll use the information you suplied within the AUX setup. 

Hi Bpry,


We have configurar a PA 5260 in order to use the AUX ip to contact (services routes AUX int) with panorama, but when we register the FW in panorama is added with IP MGMT FW IP. why? its that normal?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!