HA syn configuration

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

HA syn configuration

L1 Bithead

I have 2 PA-440 configure by HA,now one of FW hardware down,And I get a new FW from RMA.now I connect this new FW.

When I press "Sync to peer device", it prompts me that synchronization failed. I understand because I have not imported the license to the new firewall. If I import the license into the new firewall, can I directly synchronize the active firewall configuration to passive firewall?

Zhangsx_0-1670573116908.png

 

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello @ZhangShengXiang

 

this is correct understanding. If both firewalls do not have an identical set of licenses, they cannot synchronize configuration information. Having the same license is one of the pre-requisite: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/high-availability/set-up-activepassive-ha...

 

After, you have licensed your passive Firewall, also install corresponding PAN-OS, Threat/App version, then you should not have an issue to sync up.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Got it.You mean it will be syn complete when I import the license in passive firewall.whatever the Passive firewall was empty configuration.

I worried about that because Passive firewall cannot connect to internet,so it cannot download globalprotect version and others,the HA dashboard show globalprotect  mismatch will not impact on synchronization?

 

Zhangsx_1-1670618625482.png

Just need these matches in the picture.This is my understand.It's right?

Cyber Elite
Cyber Elite

Hello @ZhangShengXiang

 

thank you for reply.

 

The order of operation to bring Passive Firewall in sync should be as follows.

 

- Make sure that Passive Firewall has DNS server / NTP server, Hostname / Domain name, Time Zone,..etc configured. These settings are not HA synchronized (Here is a full list of config that is not synced between Active/Passive Firewall: Settings Don’t Sync in Active/Passive HA ) and some of them are required to connect to update portal to download the content (PAN-OS images, App/Threat updates,...)

 

- After you complete the above step, either let Firewall fetch license online from portal or import license manually if necessary. After Passive Firewall is properly licensed, you will be able to download content under: Device > Software/Global Protect/Dynamic Updates. After you install versions matching Active Firewall, you should be able to sync configuration from Active Firewall to Passive by clicking on sync to peer from Active Firewall.

 

- If you get an error preventing HA sync, I would review error and take troubleshooting from there.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi PavelK

I have syn the configuration to passive,but the globalprotect cannot download.should i make this FW to active,and can download version?

Zhangsx_0-1670821262994.png

Zhangsx_1-1670821279098.png

 

Cyber Elite
Cyber Elite

Under "Device > Setup > Services > Service Route Configuration" do you use management interface or some dataplane interface to communicate with Palo Alto Networks?

If management interface then both firewalls can pull updates and GlobalProtect software if dataplane interface then only active firewall can update.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1936 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!