Palo alto passive link shutdown mode drawaback and auto mode advantage

[ami02587]

Hi All,

I want to know Palo alto passive link shutdown mode drawaback and auto mode advantage.

Is the any issue to confiigure passive link in shutdown mode

[BPry]

Shutdown mode:

The passive device interfaces are physically down by default until an HA event, once the firewall has an HA event the passive unit brings it's interfaces online.  

Auto Mode:

Both the active and the passive units have active interfaces however the passive device gets set to discard any packets that reach it's interface, this is used in a layer-3 setup for faster failover. The IP and the MAC addresses of the L3 interfaces will have the same virtual MAC and IP addresses on both the active and passive units. In this state the passive firewall will not answer ARP requests until an HA event. 

Which you should use is dependent on how your network is setup. Auto is generally prefered as it will decrease the overall time to actually failover to your passive device.  There are downsides to Auto when we start talking about link and path monitoring and preemptive mode on the firewall and about a dozen other configuration settings that can make Auto mode less than ideal.