Setup HA now and update Licenses later?

[skiffsumner]

HI there,

Right now we have single PA-3020 as our HQ firewall.

We are planning on setting up HA on a pair of PA-3020. Right now we only have been approved for a budget of the secondary hardware. We have been approved to add matching software licenses in December. I was wondering if it is possible to setup an HA with primary firewall having full licenses and secondary not having any licenses? Then in a few months, we add licenses to secondary firewall. Obviously, we understand that if primary firewall fails we will not have URL filtering, Antivirus, Apps and threats protection on secondary. 

[Mick_Ball]

I dont think you can do this as one of the pre requisites for ha is as follows..

The same set of licenses —Licenses are unique to each device and cannot be shared between the devices. Therefore, you must license both devices identically. If both devices do not have an identical set of licenses, they cannot synchronize configuration information and maintain parity for a seamless failover.

We have several ha pairs but cannot advise further as always had licences matching.

also... I think (at least for vpn gateway license) it is cheaper to purchase one to cover a ha pair than it is to buy one for each.

however this may just have been a bit of sales pitch... Perhaps someone else could advise further.

[reaper]

@Mick_Ball is right, HA licence sets are cheaper than 2 sets of single device licences so It might be good to check in on your sales rep to get updated numbers for a HA set

technically you can build an HA with one fully licenced and one not-so-much licenced device but it will be a very ugly situation as the cluster depends on matching versions of everything and the secondary won't be able to comply, so you'll get lots of alarms and possibly some unexpected behavior, I would advise against it

in this situation you might be better off using the secondary hardware as a hot/cold standby replacement