suspend active panorama when passive panorama is rebooting

[MP18]

If passive panorama is going through reboot.

Active Panorama  shows passive panorama as unknown   

what will happen if i suspend the active Panorama ?

will all the firewalls connected to the Active panorama will get disconnected?

[LukeBullimore]

Hey @MP18

It sounds like HA has not fully initialized yet, I would not suspend at all until you can fully verify that one unit is active and one is passive - for both Panorama and Firewall HA alike.

Typically after a reboot you will see HA finalize init state after the autocommit process completes.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVBCA0

Cheers,

Luke.

[MP18]

i need to know what will happen if i suspend the active panorama while passive is rebooting?

will active will show all firewalls disconnected?

[LukeBullimore · Accepted solution]

Correct. If the passive Panorama is down and you suspend the Active Panorama, then the firewalls will disconnect from Panorama.

As I believe you ascertained in a previous post - despite the fact they are disconnected, the firewalls will still have their configuration and continue to pass traffic.

[MP18]

one more question on that

IF firewall is configured to send logs to external connector.

Firewall is disconnected from the panorama can it still pull up logs from external collector?

[LukeBullimore · Accepted solution]

The firewall still has the capability to forward logs to other destinations if it is disconnected from Panorama, yes.

For example, you have a log forwarding profile with a syslog server profile attached and forward to Panorama option checked. Even if the firewall is disconnected from Panorama the logs will still be sent to the syslog server.

[MP18]

Many thanks for answering the questions