push the commit on one member of the cluster only?

[pmartyn]

Hello,

To test the link monitoring of the high-availability, i want to shut one interface on the active member.
I set up the interface at down but i do not find how to do the commit on the active member only.
Is there a solution to push the commit on one member of the cluster only?

Thanks for your help.

[BPry · Accepted solution]

@pmartyn,

Within your High Availablility settings under setup there is an option to toggle Config Sync. Turn this off and your configuration will not sync between your passive/active members. 

[pmartyn]

@BPry,

With this option disabled, i'm able to shut interfaces on one members only :
admin@panel1(active)> show interface all
ethernet1/1             16    ukn/ukn/down(power-down)  00:1b:17:00:23:10
ethernet1/2             17    ukn/ukn/down(power-down)  00:1b:17:00:23:11

admin@panel2(passive)> show interface all
ethernet1/1             16    1000/full/up              00:1b:17:00:23:10
ethernet1/2             17    1000/full/up              00:1b:17:00:23:11

Exactly what i was looking for, thanks for your help.

But HA do not react with the following "link monitoring" configuration.

high-availability {
...
 group {
  35 {
   ...
   monitoring {
    link-monitoring {
     link-group {
      "LACP Group1" {
       interface [ ethernet1/1 ethernet1/2];
       failure-condition all;
      }
     }
    }
   }
  }
 }
}

[Raido_Rattameister]

Path and link monitoring configuration is per firewall and this is not syncronized to other firewall.

[pmartyn]

@Raido_Rattameister,

This management article https://live.paloaltonetworks.com/t5/Management-Articles/Logical-Shutdown-of-an-Interface-Does-Not-C... explains why a logical shutdown of an interface does not cause HA failover.

[Raido_Rattameister]

Yes that is the case.

But to answer your initial question - if you change link monitoring config on one firewall and commit then this is not replicated over as link and path monitoring configuration is private to the firewall.